@celilo/cli 2.2.1 → 2.3.0

package/src/db/client.test.ts

@@ -3,7 +3,8 @@ import { afterEach, describe, expect, test } from 'bun:test';
 import { rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import { createDbClient } from './client';
+import { resetTestDbPath } from '../test-utils/db-path';
+import { closeDb, createDbClient, getDb } from './client';
 
 // #798: a command that opened the db while a deploy still held it died on
 // SQLITE_BUSY immediately, because the connection carried no busy timeout.
@@ -61,3 +62,47 @@ describe('createDbClient concurrency', () => {
     }
   });
 });
+
+/**
+ * The tripwire from celilo#1343: under bun test, a default-path open must be
+ * refused instead of landing on the operator's real database. The scratch-DB
+ * preload (apps/celilo/test-preload.ts) arms CELILO_DB_PATH only when bun
+ * runs from apps/celilo/, so every one of these tests strips the redirects
+ * itself to reproduce the out-of-scope state.
+ */
+describe('createDbClient operator-database tripwire (celilo#1343)', () => {
+  afterEach(() => {
+    closeDb();
+    resetTestDbPath();
+    delete process.env.CELILO_DATA_DIR;
+    delete process.env.ENVIRONMENT;
+  });
+
+  test('default-path open under bun test throws, naming the fix', () => {
+    delete process.env.CELILO_DB_PATH;
+    delete process.env.CELILO_DATA_DIR;
+    delete process.env.ENVIRONMENT;
+
+    expect(() => getDb()).toThrow(/CELILO_DB_PATH/);
+  });
+
+  test('CELILO_DATA_DIR redirect keeps the default-path open allowed', () => {
+    delete process.env.CELILO_DB_PATH;
+    delete process.env.ENVIRONMENT;
+    process.env.CELILO_DATA_DIR = join(tmpdir(), 'celilo-tripwire-redirect');
+
+    const db = createDbClient();
+    db.$client.close();
+  });
+
+  test('explicit config path bypasses the tripwire', () => {
+    delete process.env.CELILO_DB_PATH;
+    delete process.env.CELILO_DATA_DIR;
+    delete process.env.ENVIRONMENT;
+
+    const db = createDbClient({
+      path: join(tmpdir(), 'celilo-tripwire-explicit', 'celilo.db'),
+    });
+    db.$client.close();
+  });
+});

package/src/db/client.ts

@@ -49,6 +49,32 @@ export function createDbClient(config?: Partial<DatabaseConfig>) {
   const dbPath = config?.path ?? getDbPath();
   const readonly = config?.readonly ?? false;
 
+  // Tripwire against opening the operator's real database from a test
+  // (celilo#1343). The scratch-DB preload in apps/celilo/test-preload.ts only
+  // arms when bun runs from apps/celilo/ — bun reads the bunfig at the working
+  // directory — so the same suite run from the repo root reaches this function
+  // with every override unset and would open, and migrate, the operator's
+  // ~/Library/.../celilo.db. The condition below is exactly that resolution:
+  // under bun test, with every redirect unset, getDbPath() falls through to
+  // the platform data directory. A run that is properly scoped (preload armed,
+  // CELILO_DATA_DIR redirected, or an explicit config.path) never satisfies
+  // it and pays one string comparison.
+  if (
+    !config?.path &&
+    process.env.NODE_ENV === 'test' &&
+    !process.env.CELILO_DB_PATH &&
+    !process.env.CELILO_DATA_DIR &&
+    process.env.ENVIRONMENT !== 'dev'
+  ) {
+    throw new Error(
+      'Refusing to open the celilo database under bun test with no database path set ' +
+        '(celilo#1343): the scratch-DB preload in apps/celilo/test-preload.ts only arms ' +
+        "when bun runs from apps/celilo/, so this default path is the operator's real " +
+        'celilo.db. Run tests from apps/celilo/, or set CELILO_DB_PATH (or ' +
+        'CELILO_DATA_DIR) to a test-scoped path.',
+    );
+  }
+
   // bun:sqlite's `create: true` makes the file but not the parent directory.
   // First-run after a fresh install hits this — without recursive mkdir we
   // get SQLITE_CANTOPEN before init can write its config.

package/src/db/schema.ts

@@ -212,6 +212,45 @@ export const capabilityBindings = sqliteTable(
   }),
 );
 
+/**
+ * One build-bus `on_upstream_publish` hook execution (services/build-bus/hook-dispatcher.ts).
+ *
+ * The self-update path had no durable record: outcomes were console output
+ * inside the receiver daemon, so a CLI that never upgraded looked like a
+ * healthy fleet (celilo#1304). One row per (event, module, hook) run — the
+ * newest row answers "did the self-update for @celilo/cli@X fire and succeed?".
+ *
+ * `exit_code` is NULL when the script never ran to an exit (spawn failure).
+ * Not an event-bus delivery: hooks run from the receiver's in-process
+ * dispatcher, which no `deliveries` row was ever written for.
+ *
+ * @owner celilo — build-bus self-update audit trail (celilo#1304)
+ */
+export const buildBusHookRuns = sqliteTable(
+  'build_bus_hook_runs',
+  {
+    id: integer('id').primaryKey({ autoIncrement: true }),
+    /** The PublishEvent's dedup id — joins back to the bus's `build-bus.publish` event. */
+    eventId: text('event_id').notNull(),
+    packageName: text('package_name').notNull(),
+    packageVersion: text('package_version').notNull(),
+    tag: text('tag').notNull(),
+    moduleId: text('module_id').notNull(),
+    hookName: text('hook_name').notNull(),
+    scriptPath: text('script_path').notNull(),
+    /** Null means the script never reached an exit (spawn failure). */
+    exitCode: integer('exit_code'),
+    timedOut: integer('timed_out', { mode: 'boolean' }).notNull().default(false),
+    durationMs: integer('duration_ms').notNull(),
+    stdoutTail: text('stdout_tail'),
+    stderrTail: text('stderr_tail'),
+    ranAt: integer('created_at', { mode: 'timestamp' }).notNull().default(sql`(unixepoch())`),
+  },
+  (table) => ({
+    ranAtLookup: index('build_bus_hook_runs_created_at_idx').on(table.ranAt),
+  }),
+);
+
 /**
  * Capability secrets table - stores encrypted secrets owned by capabilities
  * Values are encrypted with AES-256-GCM using master key
@@ -310,6 +349,28 @@ export const moduleIntegrity = sqliteTable('module_integrity', {
   updatedAt: integer('updated_at', { mode: 'timestamp' }).notNull().default(sql`(unixepoch())`),
 });
 
+/**
+ * Per-module hook jail policy — the operator's row in the four-step
+ * precedence (per-module-jail-policy task 1.1), ranked between the
+ * `CELILO_HOOK_JAIL` environment variable and the system-wide
+ * `hooks.jail_policy` key.
+ *
+ * One row per module; an absent row means "follow the system", so there is
+ * no default column to get wrong. The value is validated at set time by the
+ * `module jail` verb and re-validated at read time by `resolveJailPolicy`,
+ * which throws rather than coercing — a restored or hand-edited row outside
+ * the accepted set must fail loudly, the same rule the system key follows
+ * (peba's ruling on ce-8832).
+ * @owner celilo — operator-set per-module jail policy
+ */
+export const moduleJailPolicies = sqliteTable('module_jail_policies', {
+  moduleId: text('module_id')
+    .primaryKey()
+    .references(() => modules.id, { onDelete: 'cascade' }),
+  policy: text('policy').$type<'auto' | 'off' | 'required'>().notNull(),
+  updatedAt: integer('updated_at', { mode: 'timestamp' }).notNull().default(sql`(unixepoch())`),
+});
+
 /**
  * Lifecycle states an instance moves through.
  *
@@ -1579,3 +1640,5 @@ export type NotificationDelivery = typeof notificationDeliveries.$inferSelect;
 export type NewNotificationDelivery = typeof notificationDeliveries.$inferInsert;
 export type CapabilityBinding = typeof capabilityBindings.$inferSelect;
 export type NewCapabilityBinding = typeof capabilityBindings.$inferInsert;
+export type BuildBusHookRun = typeof buildBusHookRuns.$inferSelect;
+export type NewBuildBusHookRun = typeof buildBusHookRuns.$inferInsert;

package/src/hooks/capability-loader-firewall.test.ts

@@ -293,6 +293,8 @@ describe('Firewall Chain Building', () => {
       upsertModuleConfig(db, 'iptables', 'nat_ip', '192.168.0.253');
       upsertModuleConfig(db, 'iptables', 'default_route_zone', 'isp-transit');
       upsertModuleConfig(db, 'iptables', 'isolate_transit_network', true);
+      upsertModuleConfig(db, 'iptables', 'interface_baseline', 'eth0,eth2');
+      upsertModuleConfig(db, 'iptables', 'interface_zone_map', 'eth0=isp-transit,eth2=internal');
 
       const config = await loadedConfig();
       expect(config.defaultRouteZone).toBe('isp-transit');
@@ -300,6 +302,8 @@ describe('Firewall Chain Building', () => {
       // preserves the manifest-declared type, and the module tests
       // `state.isolateTransitNetwork && ...` — where 'false' would be truthy.
       expect(config.isolateTransitNetwork).toBe(true);
+      expect(config.interfaceBaseline).toEqual(['eth0', 'eth2']);
+      expect(config.interfaceZoneMap).toBe('eth0=isp-transit,eth2=internal');
     });
 
     test('single provider: the recorded interface_baseline is forwarded as a parsed list', async () => {
@@ -358,13 +362,15 @@ describe('Firewall Chain Building', () => {
       upsertModuleConfig(db, 'iptables', 'default_route_zone', 'internal');
       upsertModuleConfig(db, 'iptables', 'isolate_transit_network', true);
       upsertModuleConfig(db, 'iptables', 'interface_baseline', 'eth0,eth1');
+      upsertModuleConfig(db, 'iptables', 'interface_zone_map', 'eth0=isp-transit,eth1=internal');
 
       const config = await loadedConfig();
       expect(config.defaultRouteZone).toBe('internal');
       expect(config.isolateTransitNetwork).toBe(true);
-      // The downstream construction site already forwarded this; pinned so the
+      // The downstream construction site already forwarded these; pinned so the
       // two sites cannot drift apart again.
       expect(config.interfaceBaseline).toEqual(['eth0', 'eth1']);
+      expect(config.interfaceZoneMap).toBe('eth0=isp-transit,eth1=internal');
     });
 
     test('unset settings arrive undefined, not as a wrong default', async () => {
@@ -378,6 +384,8 @@ describe('Firewall Chain Building', () => {
       // would be silently overridden by a stale copy here.
       expect(config.defaultRouteZone).toBeUndefined();
       expect(config.isolateTransitNetwork).toBeUndefined();
+      expect(config.interfaceBaseline).toBeUndefined();
+      expect(config.interfaceZoneMap).toBeUndefined();
     });
   });
 });

package/src/hooks/capability-loader.ts

@@ -838,6 +838,10 @@ function buildCapabilityInterface(
           // baseline was recorded but never read back, so every converge stayed
           // in onboarding mode and refused instead of isolating (ce-qzxm).
           interfaceBaseline: parseInterfaceBaseline(config.interface_baseline),
+          // The learned zone-to-leg map, same round trip and the same site that
+          // dropped it. The module writes it at the end of a clean converge and
+          // reads it back to keep a managed /32 on its declared zone leg.
+          interfaceZoneMap: config.interface_zone_map as string | undefined,
           // Operator settings, forwarded verbatim. `parseStoredConfigValue`
           // preserves each manifest-declared type, so the boolean arrives as a
           // boolean and needs no coercion here.
@@ -1361,6 +1365,10 @@ async function buildFirewallChain(
         // Absent means the box has never converged cleanly, so an interface
         // celilo cannot attribute refuses rather than being disabled.
         interfaceBaseline: parseInterfaceBaseline(provConfig.interface_baseline),
+        // The managed-address resolver consults this before it reads the live
+        // address table. Dropping it makes the fallback select the management
+        // (SSH) interface, after which the bad alias can corrupt the learned map.
+        interfaceZoneMap: provConfig.interface_zone_map as string | undefined,
         // Which declared zone carries this firewall's default route, and
         // whether fronted zones may initiate into it. Both are operator
         // settings and both are read HERE or nowhere: the module declares them

package/src/hooks/executor.test.ts

@@ -4,7 +4,7 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { closeDb, getDb } from '../db/client';
 import { runMigrations } from '../db/migrate';
-import { systemConfig } from '../db/schema';
+import { modules, systemConfig } from '../db/schema';
 import type { ContractHookSignature } from '../manifest/contracts';
 import { resetTestDbPath } from '../test-utils/db-path';
 import {
@@ -347,18 +347,53 @@ describe('Hook Executor', () => {
       getDb().insert(systemConfig).values({ key: 'hooks.jail_policy', value }).run();
     };
 
-    const runVoidHook = (): Promise<Record<string, unknown>> => {
+    // The per-module row is keyed by module id, but the executor is handed
+    // the module's tree — the join the production read makes (task 1.4). The
+    // path is fake: nothing in this describe touches the filesystem beyond
+    // the scratch DB, and `existsSync(scriptPath)` fails before any policy
+    // read when it is not fake.
+    const moduleTree = (): string => join(dir, 'modules', 'fixture-module');
+    const plantModulePolicyRow = (moduleId: string, policy: string): void => {
+      getDb()
+        .insert(modules)
+        .values({
+          id: moduleId,
+          name: moduleId,
+          version: '1.0.0',
+          manifestData: {},
+          sourcePath: moduleTree(),
+        })
+        .run();
+      // Raw SQL, not the drizzle table, on purpose: the drizzle type only
+      // accepts 'auto' | 'off' | 'required', and the bad-value test models a
+      // row that arrived past every typed writer — a restore or a hand edit,
+      // the untrusted path the resolver throws on (Rule 3.7).
+      getDb()
+        .$client.prepare('INSERT INTO module_jail_policies (module_id, policy) VALUES (?, ?)')
+        .run(moduleId, policy);
+    };
+
+    const runVoidHook = (moduleTree?: string): Promise<Record<string, unknown>> => {
       const { logger } = createCapturingLogger();
-      return executeHookScript(join(FIXTURES_DIR, 'void-hook.ts'), {
-        config: configStore(),
-        secrets: secretStore(),
-        systems: [],
-        logger,
-        debug: false,
-        screenshotDir: '/tmp',
-        stateDir: '/tmp',
-        capabilities: {},
-      });
+      return executeHookScript(
+        join(FIXTURES_DIR, 'void-hook.ts'),
+        {
+          config: configStore(),
+          secrets: secretStore(),
+          systems: [],
+          logger,
+          debug: false,
+          screenshotDir: '/tmp',
+          stateDir: '/tmp',
+          capabilities: {},
+        },
+        {
+          // Absent means the system-config-only path: exactly what the tests
+          // above exercise. Present means the executor reads the module's row
+          // and resolves through it.
+          jail: moduleTree === undefined ? undefined : { modulePath: moduleTree, pathInputs: [] },
+        },
+      );
     };
 
     beforeEach(async () => {
@@ -413,6 +448,45 @@ describe('Hook Executor', () => {
       // resolver falls through to the default, which jails nobody.
       await expect(runVoidHook()).resolves.toBeDefined();
     });
+
+    test('the module row beats system config (per-module-jail-policy task 1.4)', async () => {
+      // System says jail hard; the module is exempted. The exempted module's
+      // hook runs unjailed while every other module of this host would fail —
+      // the spec's own "A module runs unjailed while the fleet is jailed".
+      plantPolicyRow('required');
+      plantModulePolicyRow('exempted-module', 'off');
+      await expect(runVoidHook(moduleTree())).resolves.toBeDefined();
+      // And the same host still jails a module with no row: `required` with
+      // no jail backend is a hard failure, so the system row stays in force.
+      // Which surface the failure takes is host-determined, and both prove
+      // the hook did not run: on a host with a jail backend it dies at mount
+      // planning (the fake module tree does not exist, "cannot be built");
+      // on a host with no backend it dies at backend detection ("no hook
+      // jail is available"). The point under test is policy precedence, not
+      // the surface. (celilo#1342: the CI runner has no bubblewrap, so the
+      // mount-planning surface is unreachable there.)
+      await expect(runVoidHook(join(dir, 'modules', 'other-module'))).rejects.toThrow(
+        /cannot be built|no hook jail is available/,
+      );
+    });
+
+    test('a bad per-module row fails the hook instead of running it unjailed', async () => {
+      plantModulePolicyRow('broken-module', 'alwayssafe');
+      await expect(runVoidHook(moduleTree())).rejects.toThrow(/module's jail policy='alwayssafe'/);
+    });
+
+    test('env beats a conflicting module row', async () => {
+      plantModulePolicyRow('exempted-module', 'off');
+      process.env.CELILO_HOOK_JAIL = 'required';
+      // The point is that the env overrode the module's `off`, so the hook
+      // is jailed and fails, not exempted and successful. Which failure it
+      // hits is host-determined: mount planning (the fake module tree does
+      // not exist) on a host with a jail backend, backend detection on a
+      // host without one. Either proves the hook did not run.
+      await expect(runVoidHook(moduleTree())).rejects.toThrow(
+        /cannot be built|no hook jail is available/,
+      );
+    });
   });
 
   describe('resolveHookTimeouts', () => {

package/src/hooks/executor.ts

@@ -366,6 +366,32 @@ function readStoredJailPolicy(): string | undefined {
   return row?.value;
 }
 
+/**
+ * The module's own recorded jail policy, or undefined when there is no row
+ * (per-module-jail-policy task 1.4). The system-key read stays its own
+ * function because the two answers come from different tables.
+ *
+ * The executor is handed the module's tree, `options.jail.modulePath`, which
+ * is `mod.sourcePath` — not its id, which the caller holds. The row is found
+ * the way the jail inputs identify the module: by joining `modules` on
+ * `source_path`, the exact string the caller passed, so no second identity
+ * is invented and none of invokeHook's callers need plumbing. Absent jail
+ * inputs (an invocation that cannot be jailed) also means no module identity
+ * and no module row to read.
+ *
+ * A bad stored value is not coerced here — `resolveJailPolicy` throws on it,
+ * the same rule the system key follows (peba's ruling on ce-8832).
+ */
+function readStoredModuleJailPolicy(modulePath: string | undefined): string | undefined {
+  if (!modulePath || !existsSync(getDbPath())) return undefined;
+  const row = getDb()
+    .$client.prepare(
+      'SELECT p.policy AS policy FROM module_jail_policies p JOIN modules m ON m.id = p.module_id WHERE m.source_path = ?',
+    )
+    .get(modulePath) as { policy: string } | undefined;
+  return row?.policy;
+}
+
 /**
  * Execute a hook script
  *
@@ -430,7 +456,11 @@ export async function executeHookScript(
       [process.execPath, HOOK_RUNNER_SPAWN_PATH],
       mountSet,
       detectJailBackend(),
-      resolveJailPolicy(process.env.CELILO_HOOK_JAIL, readStoredJailPolicy()).policy,
+      resolveJailPolicy(
+        process.env.CELILO_HOOK_JAIL,
+        readStoredModuleJailPolicy(options.jail?.modulePath),
+        readStoredJailPolicy(),
+      ).policy,
     );
     reportJail(jail, logger);
     // Only a real module hook says anything about whether this HOST jails. An

package/src/hooks/hook-jail-unreachability.test.ts

@@ -33,7 +33,7 @@ import { join, resolve } from 'node:path';
 /** Uniquely named so it never collides with a real key on a jailed dev box. */
 const PLANTED_KEY_NAME = 'id_celilo_jail_probe';
 import { executeHookScript } from './executor';
-import { detectJailBackend, jailPolicy } from './jail';
+import { detectJailBackend } from './jail';
 import { createCapturingLogger } from './logger';
 import { configStore, secretStore } from './test-fixtures/store-backed';
 import type { HookContext } from './types';
@@ -46,12 +46,15 @@ interface Probe {
 }
 
 const availability = detectJailBackend();
-// A host with a backend is not a host that JAILS: `CELILO_HOOK_JAIL=off` is an
-// operator switch and the executor honours it, so without this the suite runs
-// its assertions against a deliberately unjailed hook and reports the jail
-// broken. Only reachable since macOS gained a backend (task 4.8) — before that
-// every Mac skipped for want of one and the hole never showed.
-const jailed = availability.backend !== 'none' && jailPolicy() !== 'off';
+// Gated on the BACKEND alone, not on `jailPolicy()`. The ambient policy is an
+// operator switch (`CELILO_HOOK_JAIL=off` is the default), and reading it here
+// made the suite skip on every host with the default — measuring nothing, on
+// any platform, forever. The suite does not need the operator's blessing: it
+// sets the policy to `required` inside `runProbe()` and restores it after, so
+// the jail under test is this suite's own act, deterministic wherever a
+// backend exists. (celilo#1359: since the default became `off`, all three
+// jailed suites skipped everywhere.)
+const jailed = availability.backend !== 'none';
 
 interface Rig {
   outputs: {
@@ -208,18 +211,14 @@ describe.skipIf(!jailed)(`the jail is real (backend: ${availability.backend})`,
 describe.skipIf(jailed)('this run is not jailed', () => {
   test('says so, rather than reporting a pass it did not earn', () => {
     // Not an assertion about the product. It is the line that stops a green
-    // run on an unjailed host reading as "the jail was proven".
-    const why =
-      availability.backend === 'none'
-        ? (availability.reason ?? 'no backend')
-        : `CELILO_HOOK_JAIL=${process.env.CELILO_HOOK_JAIL}, so the operator switched the ${availability.backend} jail off here`;
+    // run on a backend-less host reading as "the jail was proven". The only
+    // way here is `backend === 'none'` — an operator who set the policy off
+    // does NOT land in this companion, because the live suite above now pins
+    // the policy itself and runs anyway (celilo#1359).
+    const why = availability.reason ?? 'no backend';
     console.log(
-      `\nhook jail: SKIPPED the live suite — ${why}\nThese properties are proven wherever a backend is available and enabled. The hermetic half runs everywhere (jail.test.ts).`,
+      `\nhook jail: SKIPPED the live suite — ${why}\nThese properties are proven wherever a jail backend is available. The hermetic half runs everywhere (jail.test.ts).`,
     );
-    // Both reasons are legitimate and they are different facts, so assert the
-    // disjunction rather than one of them. Asserting `backend === 'none'` alone
-    // went red the day macOS got a backend AND the operator turned it off — a
-    // combination that is not a defect in anything.
-    expect(availability.backend === 'none' || jailPolicy() === 'off').toBe(true);
+    expect(availability.backend === 'none').toBe(true);
   });
 });

package/src/hooks/hook-trespass.test.ts

@@ -33,7 +33,7 @@ import {
 } from '../../../../scripts/workspace-fallback';
 import { CLI_BIN_DIR, childPath, executeHookScript, hookChildEnv } from './executor';
 import { HOOK_PROTOCOL_VERSION } from './hook-protocol';
-import { detectJailBackend, jailPolicy } from './jail';
+import { detectJailBackend } from './jail';
 import { createCapturingLogger } from './logger';
 import { configStore, secretStore } from './test-fixtures/store-backed';
 import type { HookContext } from './types';
@@ -302,7 +302,14 @@ describe('hook process boundary — hello-trespass gate', () => {
 });
 
 const availability = detectJailBackend();
-const jailed = availability.backend !== 'none' && jailPolicy() !== 'off';
+// Gated on the BACKEND alone, not on `jailPolicy()`. The ambient policy is an
+// operator switch (`CELILO_HOOK_JAIL=off` is the default), and reading it here
+// made stage 2 skip on every host with the default — measuring nothing. The
+// jailed run pins the policy to `required` inside `runTrespass(true)` and
+// restores it after, so the jail under test is this suite's own act wherever a
+// backend exists. (celilo#1359: since the default became `off`, all three
+// jailed suites skipped everywhere.)
+const jailed = availability.backend !== 'none';
 
 describe.skipIf(!jailed)(
   `stage 2: the same hook, jailed (backend: ${availability.backend})`,