@celilo/cli 2.3.0 → 3.0.0

package/src/cli/commands/publish/plan.test.ts

@@ -0,0 +1,64 @@
+/**
+ * decidePhases — the pure phase-gating decision behind `celilo publish`.
+ *
+ * The module-phase flags (`--skip-modules` / `--modules-only`) exist so
+ * the release pipeline can deliver the CLI independently of the module
+ * sweep (celilo#1369). Their gating lives in one pure function so the
+ * combinations are testable without npm, git or the registry.
+ */
+
+import { describe, expect, test } from 'bun:test';
+import { decidePhases } from './plan';
+
+describe('decidePhases', () => {
+  test('normal mode, default phase: everything runs', () => {
+    expect(decidePhases({ kind: 'normal' }, 'run')).toEqual({
+      workspace: true,
+      consumerPins: true,
+      globalUpdate: true,
+      modulePublish: true,
+    });
+  });
+
+  test('--skip-modules plans no module sweep, keeps the npm phases', () => {
+    expect(decidePhases({ kind: 'normal' }, 'skip')).toEqual({
+      workspace: true,
+      consumerPins: true,
+      globalUpdate: true,
+      modulePublish: false,
+    });
+  });
+
+  test('--modules-only plans the module sweep and nothing else', () => {
+    expect(decidePhases({ kind: 'normal' }, 'only')).toEqual({
+      workspace: false,
+      consumerPins: false,
+      globalUpdate: false,
+      modulePublish: true,
+    });
+  });
+
+  test('promote is a real release — same shape as normal', () => {
+    expect(
+      decidePhases({ kind: 'promote', target: { name: '@celilo/cli', version: '1.0.0' } }, 'run'),
+    ).toEqual(decidePhases({ kind: 'normal' }, 'run'));
+  });
+
+  test('alpha still suppresses pins and the sweep without --alpha-modules', () => {
+    expect(decidePhases({ kind: 'alpha', trackAlpha: false, alphaModules: false }, 'run')).toEqual({
+      workspace: true,
+      consumerPins: false,
+      globalUpdate: false,
+      modulePublish: false,
+    });
+  });
+
+  test('alpha with --track-alpha and --alpha-modules runs its phases', () => {
+    expect(decidePhases({ kind: 'alpha', trackAlpha: true, alphaModules: true }, 'run')).toEqual({
+      workspace: true,
+      consumerPins: false,
+      globalUpdate: true,
+      modulePublish: true,
+    });
+  });
+});

package/src/cli/commands/publish/plan.ts

@@ -17,9 +17,48 @@ import { planGlobalUpdate } from './global-install';
 import { buildWorkspaceVersionMap, currentGitHead, getPublishPackages } from './helpers';
 import { planModulePublish } from './module-registry';
 import { runPreflight } from './preflight';
-import type { PublishOptions, PublishPlan } from './types';
+import type { PublishMode, PublishOptions, PublishPlan } from './types';
 import { planWorkspace } from './workspace';
 
+/**
+ * Which publish phases run, from the mode and the module-phase flag.
+ * Pure so the flag combinations stay testable without npm, git or the
+ * registry.
+ *
+ * `modulePhase` only moves the module sweep: `skip` plans no sweep (the
+ * npm phases run alone), `only` plans the sweep alone (celilo#1369's
+ * release-pipeline split — CLI delivery must not depend on the sweep,
+ * so the sweep is run as its own invocation after delivery).
+ */
+export interface PlannedPhases {
+  workspace: boolean;
+  consumerPins: boolean;
+  globalUpdate: boolean;
+  modulePublish: boolean;
+}
+
+export function decidePhases(
+  mode: PublishMode,
+  modulePhase: PublishOptions['modulePhase'],
+): PlannedPhases {
+  if (modulePhase === 'only') {
+    return { workspace: false, consumerPins: false, globalUpdate: false, modulePublish: true };
+  }
+  const runPhase2 = mode.kind !== 'alpha';
+  const runPhase3 = mode.kind !== 'alpha' || mode.trackAlpha;
+  const runModulePublish =
+    (mode.kind === 'normal' ||
+      mode.kind === 'promote' ||
+      (mode.kind === 'alpha' && mode.alphaModules)) &&
+    modulePhase !== 'skip';
+  return {
+    workspace: true,
+    consumerPins: runPhase2,
+    globalUpdate: runPhase3,
+    modulePublish: runModulePublish,
+  };
+}
+
 /**
  * Build the full publish plan. Reads from the world (preflight, npm,
  * git, fs); doesn't mutate.
@@ -40,15 +79,16 @@ import { planWorkspace } from './workspace';
  */
 export function planPublish(opts: PublishOptions): PublishPlan {
   const preflight = runPreflight();
-  const baseWorkspaceVersions = buildWorkspaceVersionMap();
-  const gitHead = currentGitHead();
+  const phases = decidePhases(opts.mode, opts.modulePhase);
 
-  const workspaceResult = planWorkspace({
-    mode: opts.mode,
-    packages: getPublishPackages(),
-    baseWorkspaceVersions,
-    gitHead,
-  });
+  const workspaceResult = phases.workspace
+    ? planWorkspace({
+        mode: opts.mode,
+        packages: getPublishPackages(),
+        baseWorkspaceVersions: buildWorkspaceVersionMap(),
+        gitHead: currentGitHead(),
+      })
+    : { items: [] };
 
   // PROJECTED publish list — what executeWorkspace would land on
   // npm if no per-package skips happen at execution time. Used to
@@ -57,26 +97,19 @@ export function planPublish(opts: PublishOptions): PublishPlan {
     .filter((item) => !item.skipReason)
     .map((item) => ({ name: item.name, version: item.versionToPublish }));
 
-  const runPhase2 = opts.mode.kind !== 'alpha';
-  const runPhase3 = opts.mode.kind !== 'alpha' || opts.mode.trackAlpha;
-  const runPhase4 =
-    opts.mode.kind === 'normal' ||
-    opts.mode.kind === 'promote' ||
-    (opts.mode.kind === 'alpha' && opts.mode.alphaModules);
-
   return {
     mode: opts.mode,
     options: opts,
     preflight,
     workspace: workspaceResult.items,
-    consumerPins: runPhase2 ? planConsumerPins() : [],
-    globalUpdate: runPhase3
+    consumerPins: phases.consumerPins ? planConsumerPins() : [],
+    globalUpdate: phases.globalUpdate
       ? planGlobalUpdate({
           justPublished: projectedPublishes,
           trackAlpha: opts.mode.kind === 'alpha' && opts.mode.trackAlpha,
         })
       : [],
-    modulePublish: runPhase4 ? planModulePublish(opts.skippedModules) : [],
+    modulePublish: phases.modulePublish ? planModulePublish(opts.skippedModules) : [],
   };
 }
 

package/src/cli/commands/publish/types.ts

@@ -63,11 +63,24 @@ export interface PublishOptions {
   mode: PublishMode;
   /**
    * Module ids to leave out of the module-registry sweep (`--skip-module
-   * <id>`, repeatable). For a module that cannot publish yet. The sweep
-   * stops at its first failed module, so one such module would otherwise
-   * take every module after it, and the release's .deb, down with it.
+   * <id>`, repeatable). For a module that cannot publish yet. A failed
+   * module no longer stops the sweep (celilo#1369), but it still fails
+   * the run at the end, so a module that cannot publish yet is held
+   * back with this instead.
    */
   skippedModules: string[];
+  /**
+   * Which part of the publish touches the module registry (`--modules-only`
+   * / `--skip-modules`). `run` is the default whole publish. `skip` runs
+   * the npm phases only; `only` runs the module sweep only.
+   *
+   * The release pipeline uses the split so CLI delivery (the .deb, the
+   * apt upload, the Forgejo release) does not depend on the module sweep
+   * succeeding: npm publishes first, the fleet delivery happens, and the
+   * module sweep runs last, where its failure reds the run without
+   * withholding the CLI (celilo#1369).
+   */
+  modulePhase: 'run' | 'skip' | 'only';
 }
 
 /**

package/src/cli/commands/subscribers-install-daemon.test.ts

@@ -0,0 +1,44 @@
+import { afterAll, describe, expect, it } from 'bun:test';
+import { mkdtempSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { handleSubscribersInstallDaemon } from './subscribers-install-daemon';
+
+// resolveCeliloPath existence-checks explicit overrides, so the render
+// needs a celilo path that exists — a fake binary in a temp dir.
+const FAKE_CELOLILO = join(mkdtempSync(join(tmpdir(), 'celilo-fake-bin-')), 'celilo');
+writeFileSync(FAKE_CELOLILO, '#!/bin/sh\n', { mode: 0o755 });
+
+// --print renders without writing, so these tests never touch unit paths.
+const PRINT_FLAGS = { print: true, 'celilo-path': FAKE_CELOLILO };
+
+const SAVED_ENV = process.env.CELILO_BUS_SECRET;
+afterAll(() => {
+  if (SAVED_ENV === undefined) delete process.env.CELILO_BUS_SECRET;
+  else process.env.CELILO_BUS_SECRET = SAVED_ENV;
+});
+
+describe('handleSubscribersInstallDaemon secret resolution', () => {
+  it('falls back to CELILO_BUS_SECRET when --secret is absent — the doctor remediation and the rendered unit both lean on that env var', async () => {
+    process.env.CELILO_BUS_SECRET = 'env-secret';
+    const result = await handleSubscribersInstallDaemon([], { ...PRINT_FLAGS });
+    if (!result.success) throw new Error(`expected success: ${result.error}`);
+  });
+
+  it('prefers the --secret flag over the environment', async () => {
+    process.env.CELILO_BUS_SECRET = 'env-secret';
+    const result = await handleSubscribersInstallDaemon([], {
+      ...PRINT_FLAGS,
+      secret: 'flag-secret',
+    });
+    if (!result.success) throw new Error(`expected success: ${result.error}`);
+    expect((result.data as { unitContent: string }).unitContent).toContain('flag-secret');
+  });
+
+  it('refuses to render when neither source has a secret', async () => {
+    delete process.env.CELILO_BUS_SECRET;
+    const result = await handleSubscribersInstallDaemon([], { ...PRINT_FLAGS });
+    if (result.success) throw new Error('expected failure');
+    expect(result.error).toContain('secret is required');
+  });
+});

package/src/cli/commands/subscribers-install-daemon.ts

@@ -0,0 +1,107 @@
+/**
+ * `celilo subscribers install-daemon` — write a systemd unit (Linux) or
+ * launchd plist (macOS) that runs the build-bus webhook receiver
+ * (`celilo subscribers serve`) under supervision. Mirrors
+ * `celilo events install-daemon` for the dispatcher: default is a
+ * per-user unit; `--system` writes the system-scope unit that survives
+ * logout/reboot — the management-plane shape. Writes the file but
+ * doesn't touch supervisor state — the operator (or the celilo-mgmt
+ * Ansible role) runs the enable/bootstrap steps themselves.
+ *
+ * The rendered unit runs `subscribers serve --no-dispatch` by default:
+ * the standing dispatcher (celilo-events.service) owns dispatch on a
+ * management box, and a second dispatcher polling the same bus is the
+ * celilo#580/#610 failure. Pass --dispatch for a combined unit on a box
+ * that has no events daemon.
+ *
+ * celilo#1304: nothing installed the receiver anywhere, so celilo-mgr's
+ * on_upstream_publish self-update could never fire. This command is the
+ * missing installer.
+ */
+
+import {
+  installReceiverDaemon,
+  planReceiverInstall,
+  uninstallReceiverDaemon,
+} from '../../services/build-bus/receiver-daemon';
+import type { CommandResult } from '../types';
+import { resolveServeSecret } from './subscribers-serve';
+
+function shortenPath(p: string): string {
+  return p.startsWith(process.env.HOME ?? '\0') ? p.replace(process.env.HOME ?? '', '~') : p;
+}
+
+function daemonScopeFrom(flags: Record<string, string | boolean>): 'user' | 'system' {
+  return flags.system === true ? 'system' : 'user';
+}
+
+export async function handleSubscribersInstallDaemon(
+  _args: string[],
+  flags: Record<string, string | boolean>,
+  env: Record<string, string | undefined> = process.env,
+): Promise<CommandResult> {
+  try {
+    const options = {
+      celiloPath: typeof flags['celilo-path'] === 'string' ? flags['celilo-path'] : undefined,
+      port: flags.port ? Number(flags.port) : undefined,
+      // Same resolution as `serve`: the flag wins, CELILO_BUS_SECRET is
+      // the documented fallback (the doctor remediation names it), and
+      // null means the renderer refuses rather than invent a secret.
+      secret: resolveServeSecret(flags, env) ?? undefined,
+      scope: daemonScopeFrom(flags),
+      dispatch: flags.dispatch === true,
+    };
+    // --print: render-only, raw unit content on stdout. The celilo-mgmt
+    // Ansible role captures this and does the root-owned write itself
+    // (the deb wrapper runs celilo as the unprivileged celilo user, so
+    // a direct --system write would EACCES on /etc/systemd/system).
+    if (flags.print) {
+      const plan = planReceiverInstall(options);
+      return { success: true, message: plan.unitContent, rawOutput: true, data: plan };
+    }
+    const result = installReceiverDaemon(options);
+    const lines = [
+      `Wrote ${result.platform} ${result.scope} unit: ${shortenPath(result.unitPath)}`,
+      `  celilo:    ${shortenPath(result.celiloPath)}`,
+      `  port:      ${result.port}`,
+      `  dispatch:  ${result.dispatch ? 'combined (receiver + hooks)' : 'receiver-only (--no-dispatch)'}`,
+      ...(result.runAsUser ? [`  runs as:   ${result.runAsUser}`] : []),
+      '',
+      'The unit embeds the shared secret the publisher must sign webhooks with —',
+      "register this host in the publisher's build-bus-subscribers.json with the",
+      'same value (`celilo subscribers add <this-host-url> --secret <same secret>`).',
+      '',
+      'Next steps (run these yourself — install does not touch supervisor state):',
+      ...result.nextSteps.map((s) => `  ${s}`),
+    ];
+    return { success: true, message: lines.join('\n'), data: result };
+  } catch (err) {
+    return {
+      success: false,
+      error: err instanceof Error ? err.message : String(err),
+    };
+  }
+}
+
+export async function handleSubscribersUninstallDaemon(
+  _args: string[],
+  flags: Record<string, string | boolean>,
+): Promise<CommandResult> {
+  try {
+    const result = uninstallReceiverDaemon({ scope: daemonScopeFrom(flags) });
+    const lines = [
+      result.removed
+        ? `Removed unit: ${shortenPath(result.unitPath)}`
+        : `No unit file at ${shortenPath(result.unitPath)} — nothing to remove.`,
+      '',
+      'Next steps:',
+      ...result.nextSteps.map((s) => `  ${s}`),
+    ];
+    return { success: true, message: lines.join('\n'), data: result };
+  } catch (err) {
+    return {
+      success: false,
+      error: err instanceof Error ? err.message : String(err),
+    };
+  }
+}

package/src/cli/commands/subscribers-serve.test.ts

@@ -0,0 +1,22 @@
+import { describe, expect, it } from 'bun:test';
+import { resolveServeSecret } from './subscribers-serve';
+
+describe('resolveServeSecret', () => {
+  it('prefers the --secret flag over the environment', () => {
+    expect(resolveServeSecret({ secret: 'flag-secret' }, { CELILO_BUS_SECRET: 'env-secret' })).toBe(
+      'flag-secret',
+    );
+  });
+
+  it('falls back to CELILO_BUS_SECRET when the flag is absent', () => {
+    expect(resolveServeSecret({}, { CELILO_BUS_SECRET: 'env-secret' })).toBe('env-secret');
+  });
+
+  it('ignores an empty env value', () => {
+    expect(resolveServeSecret({}, { CELILO_BUS_SECRET: '' })).toBeNull();
+  });
+
+  it('returns null when neither source has a secret', () => {
+    expect(resolveServeSecret({}, {})).toBeNull();
+  });
+});

package/src/cli/commands/subscribers-serve.ts

@@ -16,6 +16,24 @@ import { startHookDispatcher } from '../../services/build-bus/hook-dispatcher';
 import { startReceiverServer } from '../../services/build-bus/receiver-server';
 import type { CommandResult } from '../types';
 
+/**
+ * Resolve the receiver's shared HMAC secret. The `--secret` flag wins;
+ * otherwise `CELILO_BUS_SECRET` from the environment — which is what
+ * the supervisor unit (celilo-build-bus-receiver.service / the launchd
+ * plist) sets, and what the doctor's build-bus-publishing remediation
+ * has always told operators to export. Returns null when neither has a
+ * usable value; the caller turns that into the flag-required error.
+ */
+export function resolveServeSecret(
+  flags: Record<string, string | boolean>,
+  env: Record<string, string | undefined> = process.env,
+): string | null {
+  if (typeof flags.secret === 'string' && flags.secret) return flags.secret;
+  const fromEnv = env.CELILO_BUS_SECRET;
+  if (typeof fromEnv === 'string' && fromEnv) return fromEnv;
+  return null;
+}
+
 export async function handleSubscribersServe(
   _args: string[],
   flags: Record<string, string | boolean>,
@@ -27,11 +45,11 @@ export async function handleSubscribersServe(
       error: `Invalid --port value: ${flags.port}. Must be 1–65535.`,
     };
   }
-  const secret = flags.secret;
-  if (typeof secret !== 'string' || !secret) {
+  const secret = resolveServeSecret(flags);
+  if (!secret) {
     return {
       success: false,
-      error: '--secret <shared-hmac-secret> is required.',
+      error: '--secret <shared-hmac-secret> is required (or export CELILO_BUS_SECRET).',
     };
   }
 
@@ -47,7 +65,7 @@ export async function handleSubscribersServe(
     secret,
     onEvent: dispatcher
       ? async (envelope) => {
-          // handleEvent returns HookRunResult[]; the receiver's
+          // handleEvent returns UpstreamHookResult[]; the receiver's
           // onEvent contract is void | Promise<void>. Discard the
           // array — the dispatcher logs its own outcomes.
           await dispatcher.handleEvent(envelope.event);

package/src/cli/commands/system-audit.ts

@@ -154,8 +154,14 @@ function findMigrationsFolderSafe(): string | null {
  * indicators (FuelGauge) inside the audit subroutines and routes
  * progress messages to the caller instead — used by the TUI so
  * audit progress appears inside the alt-screen render.
+ *
+ * `quiet` (when true) silences them outright: the caller is going to
+ * emit a JSON document on stdout, and a gauge's frames are not JSON
+ * (celilo#1362).
  */
-async function buildAuditDeps(onProgress?: (msg: string) => void) {
+async function buildAuditDeps(
+  options: { onProgress?: (msg: string) => void; quiet?: boolean } = {},
+) {
   const db = getDb();
 
   const installed = db.select().from(modules).all();
@@ -210,7 +216,10 @@ async function buildAuditDeps(onProgress?: (msg: string) => void) {
     envVars: terraformEnvByModule.get(m.id) ?? {},
   }));
 
-  const healthResults = await runAllHealthChecks(db, { onProgress });
+  const healthResults = await runAllHealthChecks(db, {
+    onProgress: options.onProgress,
+    quiet: options.quiet,
+  });
 
   // Module integrity. Shallow by default: the installed tree against its
   // baseline, and the generated project against the installed tree. Both are
@@ -442,7 +451,7 @@ async function buildAuditDeps(onProgress?: (msg: string) => void) {
       // still catching a transport that has genuinely stopped being readable.
       staleAfterMs: 30 * 60_000,
     },
-    trustedSources: { firewalls: collectFirewallReach(db) },
+    trustedSources: collectFirewallReach(db),
   };
 }
 
@@ -542,7 +551,7 @@ export async function handleSystemAudit(
           // and so the spinner caption keeps changing during the
           // parallel-audit phase (which doesn't emit its own).
           onProgress('Reading system state…');
-          const deps = await buildAuditDeps(onProgress);
+          const deps = await buildAuditDeps({ onProgress });
           onProgress('Analyzing drift across categories…');
           return runAudit(deps, onCategory);
         },
@@ -559,7 +568,7 @@ export async function handleSystemAudit(
 
   let deps: Awaited<ReturnType<typeof buildAuditDeps>>;
   try {
-    deps = await buildAuditDeps();
+    deps = await buildAuditDeps({ quiet: json });
   } catch (err) {
     return {
       success: false,

package/src/cli/commands/system-update.ts

@@ -286,7 +286,11 @@ async function buildSnapshots(
  * - `health` calls `runModuleHealthCheck`.
  * - `snapshotCeliloDb` calls `createSystemStateBackup`.
  */
-function buildOps(registry: RegistryClient, wasDeployed: Set<string>): OrchestratorOps {
+function buildOps(
+  registry: RegistryClient,
+  wasDeployed: Set<string>,
+  quiet: boolean,
+): OrchestratorOps {
   return {
     backup: async (moduleId, _updateId) => {
       // IMPORTED modules don't have running state to back up; skip
@@ -362,9 +366,10 @@ function buildOps(registry: RegistryClient, wasDeployed: Set<string>): Orchestra
         return { status: 'no-checks', detail: 'not deployed; health check skipped' };
       }
       // We can call the existing health-runner directly today — that's
-      // already a clean service.
+      // already a clean service. quiet keeps the check's gauge and plain
+      // log lines off stdout when the caller asked for JSON (celilo#1362).
       const db = getDb();
-      const r = await runModuleHealthCheck(id, db);
+      const r = await runModuleHealthCheck(id, db, { quiet });
       return { status: r.status, detail: r.error };
     },
     snapshotCeliloDb: async (_updateId) => {
@@ -494,7 +499,7 @@ export async function handleSystemUpdate(
   // Build audit deps. (Mostly mirrors system-audit.ts; could be refactored
   // into a shared helper in Phase 5.)
   const migrationsFolder = findMigrationsFolderSafe();
-  const healthResults = await runAllHealthChecks(db);
+  const healthResults = await runAllHealthChecks(db, { quiet: json });
 
   // Module integrity, shallow. Local and milliseconds; the host plane is one
   // SSH per system and belongs to `module verify --deep`.
@@ -619,7 +624,7 @@ export async function handleSystemUpdate(
     // does no probing. `system audit` and the monitor sweep own this check.
     diskSpace: { results: [] },
     transportReads: { statuses: [], now: new Date(), staleAfterMs: 30 * 60_000 },
-    trustedSources: { firewalls: [] },
+    trustedSources: { firewalls: [], unreachableFirewalls: [] },
   };
 
   if (dryRun) {
@@ -687,7 +692,7 @@ export async function handleSystemUpdate(
     }
   }
 
-  const ops = buildOps(registry, wasDeployed);
+  const ops = buildOps(registry, wasDeployed, json);
 
   const result = await runSystemUpdate({
     audit: auditDeps,

package/src/cli/completion.ts

@@ -515,7 +515,16 @@ export async function getCompletions(words: string[], current: number): Promise<
 
   // Subscribers subcommands
   if (command === 'subscribers' && currentIndex === 1) {
-    const subcommands = ['list', 'add', 'remove', 'test', 'serve', 'status'];
+    const subcommands = [
+      'list',
+      'add',
+      'remove',
+      'test',
+      'serve',
+      'status',
+      'install-daemon',
+      'uninstall-daemon',
+    ];
     return filterSuggestions(subcommands, args[1] || '');
   }
 

package/src/cli/fuel-gauge.ts

@@ -56,11 +56,19 @@ export class FuelGauge {
   private linesDrawn = 0; // Track exactly how many lines were drawn last frame
   private startTime = Date.now();
   private lastOutputTime = Date.now();
+  /**
+   * Whether this gauge may draw frames on its output stream. A redirected
+   * or piped stream is a data channel, not a terminal (celilo#699), so the
+   * gauge tracks state silently there instead of writing frames into
+   * whatever file or protocol lies downstream (celilo#1362).
+   */
+  private readonly interactive: boolean;
 
   constructor(title: string, options: FuelGaugeOptions = {}) {
     this.title = title;
     this.output = options.output || stdout;
     this.skipAnimation = options.skipAnimation || false;
+    this.interactive = !this.skipAnimation && Boolean(this.output.isTTY);
     this.onBackground = options.onBackground;
   }
 
@@ -68,8 +76,8 @@ export class FuelGauge {
    * Start the fuel-gauge animation
    */
   start(): void {
-    if (this.skipAnimation) {
-      // Test mode: just track state
+    if (this.skipAnimation || !this.interactive) {
+      // Test mode or non-interactive output: just track state
       this.running = true;
       return;
     }
@@ -188,7 +196,7 @@ export class FuelGauge {
 
     this.running = false;
 
-    if (this.skipAnimation) {
+    if (!this.interactive) {
       return;
     }
 
@@ -233,7 +241,7 @@ export class FuelGauge {
   stopSilent(): void {
     if (!this.running) return;
     this.running = false;
-    if (this.skipAnimation) return;
+    if (!this.interactive) return;
     const display = getActiveDisplay();
     if (display) {
       display.abandon();

package/src/cli/index.ts

@@ -115,6 +115,10 @@ import { handleServiceSetCredentials } from './commands/service-set-credentials'
 import { handleServiceVerify } from './commands/service-verify';
 import { handleStatus } from './commands/status';
 import { handleSubscribersAdd } from './commands/subscribers-add';
+import {
+  handleSubscribersInstallDaemon,
+  handleSubscribersUninstallDaemon,
+} from './commands/subscribers-install-daemon';
 import { handleSubscribersList } from './commands/subscribers-list';
 import { handleSubscribersRemove } from './commands/subscribers-remove';
 import { handleSubscribersServe } from './commands/subscribers-serve';
@@ -365,6 +369,10 @@ Subcommands:
   test <url>                           Fire a synthetic event at a subscriber; report delivery
   serve --secret <hmac-secret>         Run the receiver daemon (verifies + emits to local bus)
        [--port <p>] [--no-dispatch]
+  install-daemon --secret <s>          Write a supervisor unit for the receiver (celilo#1304:
+       [--system] [--port <p>]         nothing else installs it). Runs serve --no-dispatch so the
+       [--dispatch] [--print]          standing dispatcher keeps owning hook delivery.
+  uninstall-daemon [--system]          Remove the receiver supervisor unit
   status                               Per-subscriber delivery history (success rate, recent failures)
   --help, -h                           Show this help
 
@@ -1909,6 +1917,10 @@ export async function runCli(argv: string[]): Promise<CommandResult> {
         return handleSubscribersTest(parsed.args);
       case 'serve':
         return handleSubscribersServe(parsed.args, parsed.flags);
+      case 'install-daemon':
+        return handleSubscribersInstallDaemon(parsed.args, parsed.flags);
+      case 'uninstall-daemon':
+        return handleSubscribersUninstallDaemon(parsed.args, parsed.flags);
       case 'status':
         return handleSubscribersStatus();
       default: