@celilo/cli 3.1.0 → 4.1.0

package/src/services/system-reboot.ts

@@ -0,0 +1,357 @@
+/**
+ * Rebooting the management server (celilo#1378).
+ *
+ * celilo already DETECTS that celilo-mgr needs a reboot — `apt-upgrade` prints
+ * needrestart's pending-kernel block — and until now offered no way to act on
+ * it. The only path was SSH and `sudo reboot`: out of band, unrecorded, and not
+ * something an agent can reach, since agents operate celilo-mgr only through
+ * the MCP server.
+ *
+ * Rebooting this box is not `systemctl reboot`. It takes down the event
+ * dispatcher, the MCP server, the remote API and anything deploying, so the
+ * reboot is gated on nothing being in flight and on explicit consent.
+ *
+ * WHY VERIFICATION IS A SECOND CALL. The process that asks for the reboot dies
+ * in it — it runs ON the host it is rebooting. So no single invocation can both
+ * reboot and report that the host came back; a command that claimed to would be
+ * reporting a request as an outcome, which is the thing the issue asks us not
+ * to do. Instead `requestReboot` records a marker carrying the CURRENT boot id,
+ * and `verifyReturn` is what reports success: it passes only once the boot id
+ * has actually changed AND the dispatcher and CLI answer. An unverified marker
+ * is a reboot that did not come back, and the audit reports it as one.
+ *
+ * WHAT "IN FLIGHT" COVERS, and what it does not. The gate is `checkInFlight`,
+ * the module-operation lock that backup and restore already consult — a deploy,
+ * uninstall, backup or restore registers there, so all four hold the reboot off.
+ * celilo#1378 also names the e2e rig lock; that one is deliberately NOT checked,
+ * because the rig runs on a developer's machine and never on celilo-mgr, so
+ * reading it here would be a check that cannot reach its subject.
+ *
+ * Every judgement here is pure over injected facts, so the refusal and the
+ * verification are both testable against a fake host.
+ */
+
+import { mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync } from 'node:fs';
+import { release } from 'node:os';
+import { dirname, join } from 'node:path';
+import { getDataDir } from '../config/paths';
+import { type InFlightConflict, checkInFlight } from './module-operations';
+
+/** Debian writes this the moment a package needs a reboot to take effect. */
+export const REBOOT_REQUIRED_PATH = '/var/run/reboot-required';
+/** …and the packages that asked for it here, one per line. */
+export const REBOOT_REQUIRED_PKGS_PATH = '/var/run/reboot-required.pkgs';
+/** The kernel's own identity for this boot. It changes on every boot, and only then. */
+export const BOOT_ID_PATH = '/proc/sys/kernel/random/boot_id';
+
+/** What the host says about whether it needs a reboot. */
+export interface RebootPendingFacts {
+  /** `/var/run/reboot-required` is present. */
+  markerPresent: boolean;
+  /** Packages named in `/var/run/reboot-required.pkgs`. */
+  deferredPackages: string[];
+  /** `uname -r`, or null when it could not be read. */
+  runningKernel: string | null;
+  /** The newest kernel installed on disk, or null when it could not be read. */
+  installedKernel: string | null;
+}
+
+export interface RebootPendingVerdict {
+  pending: boolean;
+  /** True when the host could not be asked at all — NOT the same as "no reboot needed". */
+  unmeasured: boolean;
+  /** Operator-readable reasons, in the order they were found. */
+  reasons: string[];
+}
+
+/**
+ * Two independent tells, and either one is enough.
+ *
+ * The marker file is Debian's own flag and covers the deferred service
+ * restarts. The kernel comparison covers the case the marker misses and the
+ * case #1378 was filed from: running 6.8.0-1063-raspi with 1064 installed.
+ */
+export function judgeRebootPending(facts: RebootPendingFacts): RebootPendingVerdict {
+  const { markerPresent, deferredPackages, runningKernel, installedKernel } = facts;
+
+  const kernelKnown = runningKernel !== null && installedKernel !== null;
+  // Nothing was measured: no marker AND no kernel pair to compare. An absent
+  // marker alone is not evidence of a healthy host — the file lives under
+  // /var/run, which a container or a non-Debian host simply does not have.
+  if (!markerPresent && !kernelKnown) {
+    return { pending: false, unmeasured: true, reasons: [] };
+  }
+
+  const reasons: string[] = [];
+  if (kernelKnown && runningKernel !== installedKernel) {
+    reasons.push(
+      `the running kernel is ${runningKernel} but ${installedKernel} is installed — the new kernel loads on reboot and not before`,
+    );
+  }
+  if (markerPresent) {
+    reasons.push(
+      deferredPackages.length > 0
+        ? `${REBOOT_REQUIRED_PATH} is present; deferred by: ${deferredPackages.join(', ')}`
+        : `${REBOOT_REQUIRED_PATH} is present`,
+    );
+  }
+
+  return { pending: reasons.length > 0, unmeasured: false, reasons };
+}
+
+/** Read the host's own answer. The only impure part of the detection. */
+export function collectRebootPendingFacts(
+  read: (path: string) => string | null = readFileOrNull,
+  runningKernel: string | null = null,
+  installedKernel: string | null = null,
+): RebootPendingFacts {
+  return {
+    markerPresent: read(REBOOT_REQUIRED_PATH) !== null,
+    deferredPackages: (read(REBOOT_REQUIRED_PKGS_PATH) ?? '')
+      .split('\n')
+      .map((line) => line.trim())
+      .filter((line) => line.length > 0),
+    runningKernel,
+    installedKernel,
+  };
+}
+
+function readFileOrNull(path: string): string | null {
+  try {
+    return readFileSync(path, 'utf-8');
+  } catch {
+    return null;
+  }
+}
+
+/** The marker a reboot request leaves behind, so the return can be verified. */
+export interface RebootMarker {
+  /** The boot id at the moment the reboot was requested. */
+  bootIdBefore: string;
+  /** Epoch ms. */
+  requestedAt: number;
+  /** Why the operator asked — echoed back by the audit finding. */
+  reason: string;
+}
+
+export function rebootMarkerPath(dataDir: string = getDataDir()): string {
+  return join(dataDir, 'state', 'reboot-requested.json');
+}
+
+export function readRebootMarker(path: string = rebootMarkerPath()): RebootMarker | null {
+  try {
+    const parsed = JSON.parse(readFileSync(path, 'utf-8')) as Partial<RebootMarker>;
+    if (typeof parsed.bootIdBefore !== 'string' || typeof parsed.requestedAt !== 'number') {
+      return null;
+    }
+    return {
+      bootIdBefore: parsed.bootIdBefore,
+      requestedAt: parsed.requestedAt,
+      reason: parsed.reason ?? '',
+    };
+  } catch {
+    return null;
+  }
+}
+
+export function writeRebootMarker(marker: RebootMarker, path: string = rebootMarkerPath()): void {
+  mkdirSync(dirname(path), { recursive: true });
+  writeFileSync(path, `${JSON.stringify(marker, null, 2)}\n`, 'utf-8');
+}
+
+export function clearRebootMarker(path: string = rebootMarkerPath()): void {
+  rmSync(path, { force: true });
+}
+
+export interface RequestRebootDeps {
+  /** In-flight module operations. Defaults to the real `checkInFlight`. */
+  conflicts?: () => InFlightConflict[];
+  /** This boot's id, or null when unreadable. */
+  bootId: () => string | null;
+  /** Fire the reboot. Only reached once every gate above has passed. */
+  issueReboot: () => { status: number | null };
+  writeMarker?: (marker: RebootMarker) => void;
+  now?: () => number;
+}
+
+export interface RequestRebootResult {
+  success: boolean;
+  error?: string;
+  message?: string;
+  /** The boot id recorded for `verifyReturn` to compare against. */
+  bootIdBefore?: string;
+}
+
+/**
+ * Refuse, or reboot. Consent is the CALLER's to obtain (flag or interview) —
+ * this function is the part that must not be bypassed, so it holds only the
+ * checks, never the prompt.
+ */
+export function requestReboot(deps: RequestRebootDeps, reason = ''): RequestRebootResult {
+  const conflicts = (deps.conflicts ?? checkInFlight)();
+  if (conflicts.length > 0) {
+    // Name what we are waiting on. "Busy, try later" sends the operator to
+    // guess, and the guess is usually a reboot anyway.
+    return {
+      success: false,
+      error: `Refusing to reboot: ${conflicts.length} module operation(s) in flight.\n${conflicts
+        .map((c) => `  • ${c.describe}`)
+        .join(
+          '\n',
+        )}\nWait for them to finish, or release them with \`celilo module operations clear\` if they are not really running.`,
+    };
+  }
+
+  const bootIdBefore = deps.bootId();
+  if (bootIdBefore === null) {
+    // Without a before-value there is nothing to compare after, so a reboot
+    // here could never be verified — and an unverifiable reboot of the
+    // control plane is exactly what this command exists to replace.
+    return {
+      success: false,
+      error: `Refusing to reboot: could not read this boot's id from ${BOOT_ID_PATH}, so the host coming back could not be verified afterwards.`,
+    };
+  }
+
+  (deps.writeMarker ?? writeRebootMarker)({
+    bootIdBefore,
+    requestedAt: (deps.now ?? Date.now)(),
+    reason,
+  });
+
+  const { status } = deps.issueReboot();
+  if (status !== 0) {
+    return {
+      success: false,
+      error: `Reboot command exited ${status ?? 'on a signal'}. The host was not rebooted; the pending marker is left in place for \`celilo system reboot --verify\` to clear.`,
+    };
+  }
+
+  return {
+    success: true,
+    bootIdBefore,
+    message:
+      'Reboot issued. This process goes down with the host, so it cannot report the return — ' +
+      'run `celilo system reboot --verify` once celilo-mgr answers again, or read `celilo system audit`, ' +
+      'which reports an unverified reboot as a finding.',
+  };
+}
+
+export interface VerifyReturnDeps {
+  bootId: () => string | null;
+  readMarker?: () => RebootMarker | null;
+  clearMarker?: () => void;
+  /** Is the event dispatcher alive and emitting? */
+  heartbeatLive: () => Promise<boolean>;
+  /** Does the installed CLI answer `--version`? Returns the version, or null. */
+  cliVersion: () => string | null;
+}
+
+export interface VerifyReturnResult {
+  success: boolean;
+  error?: string;
+  message?: string;
+}
+
+/**
+ * The half that is allowed to say "the host came back".
+ *
+ * All three must hold: the boot id CHANGED (so we are not reading the machine
+ * that never went down), the dispatcher is live, and the CLI answers. Any one
+ * of them alone passes on a host that is half up — a booted box whose
+ * dispatcher never started is not a successful reboot of a control plane.
+ */
+export async function verifyReturn(deps: VerifyReturnDeps): Promise<VerifyReturnResult> {
+  const marker = (deps.readMarker ?? (() => readRebootMarker()))();
+  if (marker === null) {
+    return {
+      success: false,
+      error: 'No reboot is pending verification — nothing recorded a reboot request.',
+    };
+  }
+
+  const bootIdNow = deps.bootId();
+  if (bootIdNow === null) {
+    return {
+      success: false,
+      error: `Could not read ${BOOT_ID_PATH}, so the reboot could not be verified.`,
+    };
+  }
+  if (bootIdNow === marker.bootIdBefore) {
+    return {
+      success: false,
+      error: `The host has NOT rebooted: the boot id is still ${bootIdNow}, the one recorded when the reboot was requested.`,
+    };
+  }
+
+  const heartbeat = await deps.heartbeatLive();
+  const version = deps.cliVersion();
+  if (!heartbeat || version === null) {
+    const missing = [
+      heartbeat ? null : 'the event dispatcher is not reporting a live heartbeat',
+      version === null ? 'the installed celilo CLI did not answer `--version`' : null,
+    ].filter((m): m is string => m !== null);
+    return {
+      success: false,
+      error: `The host rebooted but did not come back fully: ${missing.join('; ')}. The reboot stays unverified.`,
+    };
+  }
+
+  (deps.clearMarker ?? (() => clearRebootMarker()))();
+  return {
+    success: true,
+    message: `celilo-mgr rebooted and came back: dispatcher live, CLI ${version} answering.`,
+  };
+}
+
+/**
+ * The newest kernel the host has on disk, from /boot/vmlinuz-<release>.
+ *
+ * Compared against `os.release()` — the kernel actually running — because
+ * that pair is the #1378 condition itself. Sorted numerically per dotted
+ * component so `-1064-` beats `-999-`, which a plain string sort gets wrong.
+ */
+export function newestInstalledKernel(bootEntries: string[], prefix = 'vmlinuz-'): string | null {
+  const releases = bootEntries
+    .filter((name) => name.startsWith(prefix))
+    .map((name) => name.slice(prefix.length))
+    .filter((release) => release.length > 0);
+  if (releases.length === 0) return null;
+
+  return releases.sort(compareKernelRelease).at(-1) ?? null;
+}
+
+function compareKernelRelease(a: string, b: string): number {
+  const partsOf = (s: string) => s.split(/[.\-+]/);
+  const pa = partsOf(a);
+  const pb = partsOf(b);
+  for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+    const na = Number(pa[i]);
+    const nb = Number(pb[i]);
+    const bothNumeric = Number.isFinite(na) && Number.isFinite(nb);
+    const cmp = bothNumeric ? na - nb : (pa[i] ?? '').localeCompare(pb[i] ?? '');
+    if (cmp !== 0) return cmp;
+  }
+  return 0;
+}
+
+/** Everything the audit check needs, read from this host. */
+export function collectRebootPendingDeps(
+  bootDir = '/boot',
+  markerPath: string = rebootMarkerPath(),
+): { verdict: RebootPendingVerdict; marker: RebootMarker | null } {
+  let bootEntries: string[] = [];
+  try {
+    bootEntries = readdirSync(bootDir);
+  } catch {
+    // No /boot to read — the kernel half is simply unmeasured, which
+    // judgeRebootPending reports as such rather than as a clean host.
+  }
+
+  return {
+    verdict: judgeRebootPending(
+      collectRebootPendingFacts(readFileOrNull, release(), newestInstalledKernel(bootEntries)),
+    ),
+    marker: readRebootMarker(markerPath),
+  };
+}

package/src/services/update/orchestrator.test.ts

@@ -3,10 +3,12 @@ import type { DbClient } from '../../db/client';
 import type { ModuleManifest } from '../../manifest/schema';
 import type { AuditDeps } from '../audit';
 import { unusedPublicDnsProbe } from '../audit/public-dns';
+import type { DriftFinding } from '../audit/types';
 import { buildModuleGraph } from './dep-graph';
 import {
   type ModuleSnapshot,
   type OrchestratorOps,
+  blockersOutOfReach,
   consumerSkipReason,
   runSystemUpdate,
 } from './orchestrator';
@@ -73,6 +75,12 @@ const cleanAudit: AuditDeps = {
   schema: { journal: () => null, applied: () => [], db: fakeDb },
   capabilityAbi: { modules: [] },
   browserPin: { consumers: [], provisioned: null },
+  serverBunPin: {
+    pinnedVersion: '1.4.2',
+    runningVersion: '1.4.2',
+    pinPath: '/etc/celilo/mise.pin.toml',
+  },
+  rebootPending: { verdict: { pending: false, unmeasured: false, reasons: [] }, marker: null },
   terraformPlan: { modules: [], run: async () => ({ exitCode: 0, stdout: '', stderr: '' }) },
   moduleVersions: { installed: [], fetcher: async () => ({ latest: null }) },
   moduleConfigs: { modules: [] },
@@ -88,6 +96,7 @@ const cleanAudit: AuditDeps = {
   secretsDecryptable: { results: [] },
   servicesReachable: { results: [] },
   machinesReachable: { results: [] },
+  machineInterfaceZones: { machines: [] },
   diskSpace: { results: [] },
   transportReads: { statuses: [], now: new Date(), staleAfterMs: 30 * 60_000 },
   trustedSources: { firewalls: [], unreachableFirewalls: [] },
@@ -162,6 +171,8 @@ describe('runSystemUpdate', () => {
     expect(result.audit.verdict).toBe('BLOCKED');
     expect(result.modules).toEqual([]);
     expect(upgradeCalls).toBe(0);
+    // Not `no-network` — the network is fine; the audit is what refused.
+    expect(result.selfUpdate).toEqual({ performed: false, reason: 'audit-blocked' });
   });
 
   test('happy path: clean audit + one drifting module → backup, upgrade, deploy, health, done', async () => {
@@ -471,3 +482,156 @@ describe('runSystemUpdate', () => {
     expect([...seenIds]).toEqual(['shared-id']);
   });
 });
+
+describe('blockersOutOfReach', () => {
+  const abiBlocker = (subject: string): DriftFinding => ({
+    category: 'capability_abi',
+    severity: 'blocked',
+    code: 'capability_abi_provider_mismatch',
+    message: `${subject} provides public_web@3.1.0 but framework runtime expects 4.0.0`,
+    subject,
+  });
+
+  test('an unscoped run cannot reach any blocker', () => {
+    expect(blockersOutOfReach([abiBlocker('caddy')], undefined)).toHaveLength(1);
+  });
+
+  test('--module X reaches a blocker about X', () => {
+    expect(blockersOutOfReach([abiBlocker('caddy')], 'caddy')).toEqual([]);
+  });
+
+  test('--module Y does not reach a blocker about X', () => {
+    const out = blockersOutOfReach([abiBlocker('caddy')], 'celilo-mgmt');
+    expect(out.map((f) => f.subject)).toEqual(['caddy']);
+  });
+
+  test('--module X never reaches a system-wide blocker', () => {
+    const systemBlocker: DriftFinding = {
+      category: 'schema',
+      severity: 'blocked',
+      code: 'schema_pending_migrations',
+      message: '1 pending migration',
+      subject: 'system',
+    };
+    const out = blockersOutOfReach([abiBlocker('caddy'), systemBlocker], 'caddy');
+    expect(out.map((f) => f.subject)).toEqual(['system']);
+  });
+
+  test('non-blocking findings are never returned', () => {
+    const drift: DriftFinding = {
+      category: 'module_versions',
+      severity: 'drift',
+      code: 'module_version_drift',
+      message: 'caddy 1.0.0 → 1.1.0',
+      subject: 'caddy',
+    };
+    expect(blockersOutOfReach([drift], undefined)).toEqual([]);
+  });
+});
+
+describe('runSystemUpdate with a module-scoped BLOCKED audit', () => {
+  // caddy is deployed and provides public_web@3.1.0 while the runtime
+  // contract is at 4.0.0 — the celilo#1381 shape. Upgrading caddy is
+  // exactly what the blocking finding asks for.
+  const abiBlockedAudit: AuditDeps = {
+    ...cleanAudit,
+    capabilityAbi: {
+      modules: [
+        {
+          id: 'caddy',
+          state: 'VERIFIED',
+          manifest: makeManifest('caddy', { provides: ['public_web'] }),
+        },
+      ],
+      contractVersions: { public_web: '2.0.0' },
+    },
+  };
+
+  function run(onlyModule: string | undefined, ops: OrchestratorOps) {
+    return runSystemUpdate({
+      audit: abiBlockedAudit,
+      graph: buildModuleGraph([
+        makeManifest('caddy', { provides: ['public_web'] }),
+        makeManifest('celilo-mgmt'),
+      ]),
+      snapshots: new Map([
+        ['caddy', makeSnapshot('caddy', { installed: '1.0.0', latest: '1.1.0' })],
+        ['celilo-mgmt', makeSnapshot('celilo-mgmt', { installed: '1.0.0', latest: '1.1.0' })],
+      ]),
+      ops,
+      selfUpdate: {
+        installedVersion: '0.1.5',
+        fetcher: async () => '0.1.5',
+        updater: async () => ({ ok: true, stderr: '' }),
+      },
+      progress: capturingProgress(),
+      now: () => new Date('2026-04-25T00:00:00Z'),
+      idGen: () => 'fixed-id',
+      onlyModule,
+    });
+  }
+
+  test('--module caddy upgrades caddy, with backup and health still run', async () => {
+    const calls: string[] = [];
+    const ops = makeOps({
+      backup: async (id) => {
+        calls.push(`backup:${id}`);
+        return { ok: true };
+      },
+      upgrade: async (id) => {
+        calls.push(`upgrade:${id}`);
+        return { ok: true };
+      },
+      deploy: async (id) => {
+        calls.push(`deploy:${id}`);
+        return { ok: true };
+      },
+      health: async (id) => {
+        calls.push(`health:${id}`);
+        return { status: 'healthy' };
+      },
+    });
+
+    const result = await run('caddy', ops);
+
+    expect(result.audit.verdict).toBe('BLOCKED');
+    expect(result.modules.map((m) => m.moduleId)).toEqual(['caddy']);
+    expect(result.modules[0]?.step).toBe('done');
+    expect(calls).toEqual(['backup:caddy', 'upgrade:caddy', 'deploy:caddy', 'health:caddy']);
+  });
+
+  test('--module celilo-mgmt refuses, naming the caddy finding, and never says no-network', async () => {
+    let upgrades = 0;
+    const ops = makeOps({
+      upgrade: async () => {
+        upgrades++;
+        return { ok: true };
+      },
+    });
+
+    const result = await run('celilo-mgmt', ops);
+
+    expect(result.ok).toBe(false);
+    expect(result.modules).toEqual([]);
+    expect(upgrades).toBe(0);
+    expect(result.selfUpdate).toEqual({ performed: false, reason: 'audit-blocked' });
+    const blocked = result.audit.findings.filter((f) => f.severity === 'blocked');
+    expect(blocked.map((f) => f.subject)).toEqual(['caddy']);
+  });
+
+  test('an unscoped run still refuses', async () => {
+    let upgrades = 0;
+    const ops = makeOps({
+      upgrade: async () => {
+        upgrades++;
+        return { ok: true };
+      },
+    });
+
+    const result = await run(undefined, ops);
+
+    expect(result.ok).toBe(false);
+    expect(result.modules).toEqual([]);
+    expect(upgrades).toBe(0);
+  });
+});

package/src/services/update/orchestrator.ts

@@ -20,6 +20,7 @@
 
 import { runAudit } from '../audit';
 import type { AuditDeps, SystemAuditReport } from '../audit';
+import type { DriftFinding } from '../audit/types';
 import {
   type ModuleGraph,
   type ModuleId,
@@ -133,6 +134,29 @@ export function consumerSkipReason(
   return null; // compatible; consumer can proceed against still-installed provider
 }
 
+/**
+ * The blocking findings a run cannot clear by doing its own work.
+ *
+ * `system update` used to refuse on ANY blocked finding, which made the
+ * command unable to fix the condition that stopped it: when a provider is
+ * behind a capability major, upgrading that provider is the remediation,
+ * and `--module <provider>` was refused too (celilo#1381).
+ *
+ * A finding is within reach only when the run is scoped to one module
+ * (`--module`) and the finding is about that same module — that module's
+ * upgrade is what the finding asks for. Findings about `system` or about
+ * any other module are never within reach: nothing this run does touches
+ * them. An unscoped run therefore still refuses on every blocker, as before.
+ */
+export function blockersOutOfReach(
+  findings: DriftFinding[],
+  onlyModule: string | undefined,
+): DriftFinding[] {
+  const blocked = findings.filter((f) => f.severity === 'blocked');
+  if (!onlyModule) return blocked;
+  return blocked.filter((f) => f.subject !== onlyModule);
+}
+
 /**
  * Drive a single module through the state machine. Stops at the first
  * failed step.
@@ -218,20 +242,27 @@ export async function runSystemUpdate(deps: RunUpdateDeps): Promise<SystemUpdate
 
   deps.progress.emit({ kind: 'plan', modules: deps.snapshots.size });
 
-  // Audit first; bail if BLOCKED.
+  // Audit first; bail if BLOCKED and the selected module can't clear it.
   const audit: SystemAuditReport = await runAudit(deps.audit);
   if (audit.verdict === 'BLOCKED') {
-    return {
-      version: 1,
-      updateId,
-      startedAt,
-      finishedAt: now().toISOString(),
-      audit,
-      selfUpdate: { performed: false, reason: 'no-network' },
-      backupsCreated: false,
-      modules: [],
-      ok: false,
-    };
+    const stillBlocking = blockersOutOfReach(audit.findings, deps.onlyModule);
+    if (stillBlocking.length > 0) {
+      deps.progress.emit({
+        kind: 'self-update-skipped',
+        reason: `audit BLOCKED: ${stillBlocking.map((f) => `${f.subject}: ${f.message}`).join('; ')}`,
+      });
+      return {
+        version: 1,
+        updateId,
+        startedAt,
+        finishedAt: now().toISOString(),
+        audit,
+        selfUpdate: { performed: false, reason: 'audit-blocked' },
+        backupsCreated: false,
+        modules: [],
+        ok: false,
+      };
+    }
   }
 
   // Self-update.

package/src/services/update/types.ts

@@ -43,7 +43,16 @@ export interface ModuleUpdateState {
 }
 
 export type SelfUpdateResult =
-  | { performed: false; reason: 'already-current' | 'dev-mode' | 'no-network' }
+  | {
+      performed: false;
+      /**
+       * `audit-blocked` means the run refused before the self-update was
+       * attempted. It exists because that refusal used to report
+       * `no-network` (celilo#1381), sending operators to debug a network
+       * that was fine.
+       */
+      reason: 'already-current' | 'dev-mode' | 'no-network' | 'audit-blocked';
+    }
   | { performed: true; from: string; to: string };
 
 export interface SystemUpdateResult {