@celilo/cli 4.0.0 → 5.0.0

package/src/cli/command-tree-parser.ts

@@ -100,12 +100,16 @@ export class CommandTreeParser {
 
     // Track whether we're in a Commands/Subcommands section
     let inCommandSection = false;
+    // Column where the last parsed entry's description starts; anything indented
+    // that far is wrapped prose, not a subcommand.
+    let descriptionColumn: number | null = null;
 
     for (const line of lines) {
       // Check if we're entering a Commands section
       // Match "  Commands:" or "│  Commands:"
       if (/^[│\s]*(Commands|Subcommands):\s*$/i.test(line)) {
         inCommandSection = true;
+        descriptionColumn = null;
         continue;
       }
 
@@ -134,8 +138,16 @@ export class CommandTreeParser {
       // "    command-name   Description"
       const match = line.match(/^[│\s]*([a-z][a-z0-9-]*)(?:\s{2,}|\s+[<a-z])/);
 
+      // A wrapped description's continuation lines are indented to the previous
+      // entry's description column and match the pattern above (celilo#1409).
+      const indent = line.search(/[^│\s]/);
+      if (descriptionColumn !== null && indent >= descriptionColumn) {
+        continue;
+      }
+
       if (match) {
         const cmdName = match[1];
+        descriptionColumn = match[0].length;
 
         // Skip examples (lines starting with "celilo")
         if (cmdName === 'celilo') {

package/src/cli/commands/api.ts

@@ -9,6 +9,7 @@ import { existsSync, mkdirSync, readFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { dirname, join } from 'node:path';
 import {
+  getPrincipalByName,
   grantPrincipal,
   listPrincipals,
   renderAuthorizedKeys,
@@ -22,7 +23,25 @@ function errMsg(error: unknown): string {
   return error instanceof Error ? error.message : String(error);
 }
 
-/** `celilo api grant <principal> --key <pubkey|path> --can <grant[,grant...]>` */
+function grantList(value: unknown): string[] {
+  return typeof value === 'string'
+    ? value
+        .split(',')
+        .map((g) => g.trim())
+        .filter(Boolean)
+    : [];
+}
+
+/**
+ * `celilo api grant <principal> [--key <pubkey|path>] --can|--add|--remove <grant[,...]>`
+ *
+ * `--can` REPLACES the grant set; `--add`/`--remove` amend it. Replace-only was
+ * the whole surface, so adding one permission meant re-supplying the full list
+ * plus the key, and a typo in either silently narrowed the principal or changed
+ * its key (celilo#1404). So: `--key` is required only when CREATING a principal,
+ * and a `--can` that drops grants an existing principal holds is refused unless
+ * `--force` says the narrowing is intended.
+ */
 export async function handleApiGrant(
   args: string[],
   flags: Record<string, boolean | string> = {},
@@ -32,37 +51,71 @@ export async function handleApiGrant(
     if (!name) {
       return {
         success: false,
-        error: 'Usage: celilo api grant <principal> --key <pubkey|path> --can <grant[,grant...]>',
+        error:
+          'Usage: celilo api grant <principal> [--key <pubkey|path>] --can|--add|--remove <grant[,grant...]>',
       };
     }
 
-    const keyArg = typeof flags.key === 'string' ? flags.key : '';
-    if (!keyArg) {
+    const replace = grantList(flags.can);
+    const added = grantList(flags.add);
+    const removed = grantList(flags.remove);
+    if (replace.length > 0 && (added.length > 0 || removed.length > 0)) {
       return {
         success: false,
-        error: '--key <public-key-or-path> is required (e.g. ~/.ssh/id_ed25519.pub)',
+        error: '--can replaces the grant set; use it OR --add/--remove, not both.',
+      };
+    }
+    if (replace.length === 0 && added.length === 0 && removed.length === 0) {
+      return {
+        success: false,
+        error:
+          'One of --can <grants> (replace), --add <grants>, or --remove <grants> is required (e.g. --add module:journal).',
       };
     }
 
-    const canArg = typeof flags.can === 'string' ? flags.can : '';
-    if (!canArg) {
+    const existing = await getPrincipalByName(name);
+    if (!existing && (added.length > 0 || removed.length > 0)) {
       return {
         success: false,
-        error: '--can <grant[,grant...]> is required (e.g. --can module:deploy,service:*)',
+        error: `No API principal named "${name}" — --add/--remove amend an existing one. Create it with --key and --can.`,
       };
     }
 
-    const publicKey = existsSync(keyArg) ? readFileSync(keyArg, 'utf8').trim() : keyArg.trim();
-    const grants = canArg
-      .split(',')
-      .map((g) => g.trim())
-      .filter(Boolean);
+    const keyArg = typeof flags.key === 'string' ? flags.key : '';
+    if (!keyArg && !existing) {
+      return {
+        success: false,
+        error: '--key <public-key-or-path> is required (e.g. ~/.ssh/id_ed25519.pub)',
+      };
+    }
+    // Keep the enrolled key when none is supplied, so amending grants can never
+    // rotate the key by omission.
+    const publicKey = keyArg
+      ? existsSync(keyArg)
+        ? readFileSync(keyArg, 'utf8').trim()
+        : keyArg.trim()
+      : (existing?.publicKey ?? '');
+
+    const current = existing?.grants ?? [];
+    let grants: string[];
+    if (replace.length > 0) {
+      const dropped = current.filter((g) => !replace.includes(g));
+      if (dropped.length > 0 && flags.force !== true) {
+        return {
+          success: false,
+          error: `Refusing to narrow "${name}": --can would drop ${dropped.join(', ')}. Use --add/--remove to amend, or --force to replace anyway.`,
+        };
+      }
+      grants = replace;
+    } else {
+      grants = [...new Set([...current, ...added])].filter((g) => !removed.includes(g));
+    }
 
     const { principal, created } = await grantPrincipal({ name, publicKey, grants });
 
     return {
       success: true,
-      message: `${created ? 'Granted' : 'Updated'} API access for "${principal.name}" → ${grants.join(', ')}\n\nInstall the forced-command line on celilo-mgr with:\n  celilo api authorized-keys >> ~celilo-api/.ssh/authorized_keys`,
+      message: `${created ? 'Granted' : 'Updated'} API access for "${principal.name}" → ${grants.join(', ') || '(none)'}\n\nInstall the forced-command line on celilo-mgr with:\n  celilo api authorized-keys >> ~celilo-api/.ssh/authorized_keys`,
     };
   } catch (error) {
     return { success: false, error: `Failed to grant API access: ${errMsg(error)}` };

package/src/cli/commands/events.ts

@@ -6,7 +6,7 @@
  * second tool.
  *
  * Subcommands:
- *   status               bus.health() as JSON
+ *   status               bus.healthConfirmed() as JSON
  *   tail                 recent events
  *   list-subscribers     persistent subscribers
  *   list-pending         pending deliveries (subscriber fan-out — NOT questions)
@@ -80,7 +80,10 @@ function jsonResult(data: unknown): CommandResult {
 export async function handleEventsStatus(): Promise<CommandResult> {
   const bus = openCliBus();
   try {
-    return jsonResult(bus.health());
+    // Confirmed: the ansible task and the fleet check both read this verdict and
+    // act on it, so it must not say `wedged` about a dispatcher the reconcile path
+    // calls `lagging` (celilo#1399). One threshold, one answer.
+    return jsonResult(await bus.healthConfirmed());
   } finally {
     bus.close();
   }

package/src/cli/commands/machine-reclassify.ts

@@ -0,0 +1,79 @@
+/**
+ * Machine Reclassify Command
+ *
+ * Re-runs zone detection over a machine's STORED interface labels and reports
+ * old → new. Dry-run by default: an operator sees every relabel before any of
+ * them is written. `--apply` writes.
+ *
+ * See services/machine-interface-zones.ts for why stale labels happen.
+ */
+
+import { eq } from 'drizzle-orm';
+import { getDb } from '../../db/client';
+import { machines } from '../../db/schema';
+import { applyReclassification, diffInterfaceZones } from '../../services/machine-interface-zones';
+import { getMachineByHostname, getMachineByIp } from '../../services/machine-pool';
+import { detectZoneFromIp } from '../../services/zone-detector';
+import { celiloIntro, celiloOutro } from '../prompts';
+import type { CommandResult } from '../types';
+
+const USAGE =
+  'Usage:\n  celilo machine reclassify <hostname|ip>          # show what would change\n  celilo machine reclassify <hostname|ip> --apply  # write the new labels';
+
+export async function handleMachineReclassify(
+  args: string[],
+  flags: Record<string, boolean | string> = {},
+): Promise<CommandResult> {
+  try {
+    celiloIntro('Re-classify Machine Interfaces');
+
+    const identifier = args[0];
+    if (!identifier) {
+      return { success: false, error: `Machine hostname or IP is required\n\n${USAGE}` };
+    }
+
+    const isIp = /^\d+\.\d+\.\d+\.\d+$/.test(identifier);
+    const machine = isIp
+      ? await getMachineByIp(identifier)
+      : await getMachineByHostname(identifier);
+
+    if (!machine) {
+      return { success: false, error: `Machine not found: ${identifier}` };
+    }
+
+    const interfaces = machine.interfaces ?? [];
+    const changes = await diffInterfaceZones(interfaces, detectZoneFromIp);
+
+    if (changes.length === 0) {
+      celiloOutro(
+        `${machine.hostname}: all ${interfaces.length} interface zone label(s) already match the current zone model`,
+      );
+      return { success: true, message: `${machine.hostname}: no re-classification needed` };
+    }
+
+    const lines = changes.map((c) => `  ${c.name} (${c.ipAddress}): ${c.from} → ${c.to}`);
+    const summary = `${machine.hostname}: ${changes.length} interface(s) would be re-classified\n${lines.join('\n')}`;
+
+    if (!flags.apply) {
+      celiloOutro(`${summary}\n\nRe-run with --apply to write these labels.`);
+      return { success: true, message: summary };
+    }
+
+    getDb()
+      .update(machines)
+      .set({ interfaces: applyReclassification(interfaces, changes) })
+      .where(eq(machines.id, machine.id))
+      .run();
+
+    celiloOutro(`${summary}\n\nWritten.`);
+    return {
+      success: true,
+      message: `${machine.hostname}: re-classified ${changes.length} interface(s)`,
+    };
+  } catch (error) {
+    return {
+      success: false,
+      error: `Failed to re-classify machine interfaces: ${error instanceof Error ? error.message : String(error)}`,
+    };
+  }
+}

package/src/cli/commands/module-changeset.test.ts

@@ -10,7 +10,7 @@ beforeEach(async () => {
   dir = await mkdtemp(join(tmpdir(), 'celilo-cs-'));
   await writeFile(
     join(dir, 'manifest.yml'),
-    'celilo_contract: "1.0"\nid: lunacycle\nversion: 1.0.0\n',
+    'celilo_contract: "2.0"\nid: lunacycle\nversion: 1.0.0\n',
   );
 });
 afterEach(async () => {

package/src/cli/commands/module-generate.test.ts

@@ -9,7 +9,7 @@ const DECLARED = join('ansible', 'roles', 'fixture', 'files', 'binary');
 
 function manifestWithArtifacts(artifacts: string[]): ModuleManifest {
   return {
-    celilo_contract: '1.0',
+    celilo_contract: '2.0',
     id: 'fixture',
     name: 'Fixture',
     version: '1.0.0',
@@ -42,7 +42,7 @@ describe('missingBuildOutputs', () => {
   test('reports nothing for a module with no build block', () => {
     expect(
       missingBuildOutputs(payload, {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'fixture',
         name: 'Fixture',
         version: '1.0.0',

package/src/cli/commands/module-import-aspect.test.ts

@@ -32,7 +32,7 @@ function insertAspectModule(id: string, version: string): void {
         id,
         name: id,
         version,
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         base_module_aspect: aspect,
       },
       sourcePath: `/tmp/${id}`,
@@ -102,7 +102,7 @@ describe('handleAspectApprovalAfterImport (non-interactive)', () => {
         id: 'caddy',
         name: 'caddy',
         version: '1.0.0',
-        manifestData: { id: 'caddy', name: 'caddy', version: '1.0.0', celilo_contract: '1.0' },
+        manifestData: { id: 'caddy', name: 'caddy', version: '1.0.0', celilo_contract: '2.0' },
         sourcePath: '/tmp/caddy',
       })
       .run();

package/src/cli/commands/module-update.test.ts

@@ -95,7 +95,7 @@ describe('updateOne — displayVersion and quiet', () => {
     mkdirSync(srcDir, { recursive: true });
     writeFileSync(
       join(srcDir, 'manifest.yml'),
-      `celilo_contract: "1.0"
+      `celilo_contract: "2.0"
 id: testmod
 name: Test Module
 version: 1.0.0
@@ -117,7 +117,7 @@ description: fixture
         version: '1.0.0+5',
         updatedAt: new Date('2026-04-25T16:26:31Z'),
         manifestData: {
-          celilo_contract: '1.0',
+          celilo_contract: '2.0',
           id: 'testmod',
           name: 'Test Module',
           version: '1.0.0',
@@ -195,7 +195,7 @@ description: fixture
     // row's manifestData should reflect the removal.
     writeFileSync(
       join(srcDir, 'manifest.yml'),
-      `celilo_contract: "1.0"
+      `celilo_contract: "2.0"
 id: testmod
 name: Test Module Renamed
 version: 2.0.0
@@ -210,7 +210,7 @@ variables:
     db.update(modules)
       .set({
         manifestData: {
-          celilo_contract: '1.0',
+          celilo_contract: '2.0',
           id: 'testmod',
           name: 'Test Module',
           version: '1.0.0',
@@ -249,7 +249,7 @@ variables:
     try {
       writeFileSync(
         join(srcDir, 'manifest.yml'),
-        `celilo_contract: "1.0"
+        `celilo_contract: "2.0"
 id: testmod
 name: Test Module
 version: 1.1.0
@@ -302,7 +302,7 @@ describe('registry sweep — an unanswered breaking update is not a decline', ()
         sourcePath: join(tempDir, 'installed'),
         version: '1.0.2+9',
         manifestData: {
-          celilo_contract: '1.0',
+          celilo_contract: '2.0',
           id: 'iptables',
           name: 'iptables',
           version: '1.0.2',
@@ -376,7 +376,7 @@ describe("updateOne — pointed at the module's own installed path", () => {
     mkdirSync(installedDir, { recursive: true });
     writeFileSync(
       join(installedDir, 'manifest.yml'),
-      `celilo_contract: "1.0"
+      `celilo_contract: "2.0"
 id: selfmod
 name: Self Module
 version: 1.0.0
@@ -392,7 +392,7 @@ description: fixture
         sourcePath: installedDir,
         version: '1.0.0',
         manifestData: {
-          celilo_contract: '1.0',
+          celilo_contract: '2.0',
           id: 'selfmod',
           name: 'Self Module',
           version: '1.0.0',
@@ -480,7 +480,7 @@ describe('updateOne — an update that fails partway leaves the install untouche
     mkdirSync(join(installedDir, 'generated'), { recursive: true });
     writeFileSync(
       join(installedDir, 'manifest.yml'),
-      'celilo_contract: "1.0"\nid: testmod\nname: Test Module\nversion: 1.0.0\ndescription: fixture\n',
+      'celilo_contract: "2.0"\nid: testmod\nname: Test Module\nversion: 1.0.0\ndescription: fixture\n',
     );
     writeFileSync(join(installedDir, 'scripts', 'on_install.ts'), 'export const OLD = 1;\n');
     // `derived` — celilo's own output, must survive an update either way.
@@ -490,7 +490,7 @@ describe('updateOne — an update that fails partway leaves the install untouche
     mkdirSync(join(srcDir, 'scripts'), { recursive: true });
     writeFileSync(
       join(srcDir, 'manifest.yml'),
-      'celilo_contract: "1.0"\nid: testmod\nname: Test Module\nversion: 2.0.0\ndescription: fixture\n',
+      'celilo_contract: "2.0"\nid: testmod\nname: Test Module\nversion: 2.0.0\ndescription: fixture\n',
     );
     writeFileSync(join(srcDir, 'scripts', 'on_install.ts'), 'export const NEW = 2;\n');
     // cpSync refuses a FIFO with ENOTSUP. Sorts last, so the real files copy first.
@@ -504,7 +504,7 @@ describe('updateOne — an update that fails partway leaves the install untouche
         sourcePath: installedDir,
         version: '1.0.0',
         manifestData: {
-          celilo_contract: '1.0',
+          celilo_contract: '2.0',
           id: 'testmod',
           name: 'Test Module',
           version: '1.0.0',
@@ -588,7 +588,7 @@ describe('updateOne — a .netapp package source', () => {
     mkdirSync(installedDir, { recursive: true });
     writeFileSync(
       join(installedDir, 'manifest.yml'),
-      'celilo_contract: "1.0"\nid: testmod\nname: Test Module\nversion: 1.0.0\ndescription: fixture\n',
+      'celilo_contract: "2.0"\nid: testmod\nname: Test Module\nversion: 1.0.0\ndescription: fixture\n',
     );
 
     db = getDb();
@@ -599,7 +599,7 @@ describe('updateOne — a .netapp package source', () => {
         sourcePath: installedDir,
         version: '1.0.0+5',
         manifestData: {
-          celilo_contract: '1.0',
+          celilo_contract: '2.0',
           id: 'testmod',
           name: 'Test Module',
           version: '1.0.0',
@@ -626,7 +626,7 @@ describe('updateOne — a .netapp package source', () => {
     mkdirSync(srcDir, { recursive: true });
     writeFileSync(
       join(srcDir, 'manifest.yml'),
-      'celilo_contract: "1.0"\nid: testmod\nname: Test Module\nversion: 2.0.0\ndescription: fixture v2\n',
+      'celilo_contract: "2.0"\nid: testmod\nname: Test Module\nversion: 2.0.0\ndescription: fixture v2\n',
     );
     const pkgPath = join(tempDir, 'testmod-2.0.0.netapp');
     await tarCreate({ file: pkgPath, cwd: srcDir }, ['manifest.yml']);

package/src/cli/commands/module-upgrade-gate.test.ts

@@ -45,7 +45,7 @@ async function packageWithManifest(manifestYaml: string): Promise<ArrayBuffer> {
 }
 
 const MANIFEST = (publicWebVersion: string) => `
-celilo_contract: "1.0"
+celilo_contract: "2.0"
 id: celilo-website
 name: Celilo Website
 version: 2.0.0
@@ -152,3 +152,28 @@ describe('handleModuleUpgrade — the capability gate (celilo#1361)', () => {
     }
   });
 });
+
+describe('handleModuleUpgrade — provider AHEAD is terminal (celilo#1414)', () => {
+  test('fails, does not defer, when every blocker is major_mismatch_lower', async () => {
+    // Consumer requires public_web@3.1.0; the deployed caddy serves 4.0.0.
+    // No retry can fix that — the consumer's source has to move.
+    seedFleet('4.0.0');
+    downloadSpy.mockImplementation(async () => packageWithManifest(MANIFEST('3.1.0')));
+
+    const result = await handleModuleUpgrade(['celilo-website'], {});
+
+    expect(result.success).toBe(false);
+    if (!result.success) {
+      expect(result.deferred).toBeUndefined();
+      expect(result.error).not.toContain('retries automatically');
+      expect(result.error).toContain('public_web');
+    }
+    // Still no state change: a terminal blocker must not record the version.
+    const row = getDb()
+      .select()
+      .from(modules)
+      .all()
+      .find((m) => m.id === 'celilo-website');
+    expect(row?.version).toBe('1.0.5');
+  });
+});

package/src/cli/commands/module-upgrade.test.ts

@@ -180,7 +180,7 @@ describe('upgradeOneModule — a failed deploy records the failure in the row (c
     mkdirSync(installedDir, { recursive: true });
     writeFileSync(
       join(installedDir, 'manifest.yml'),
-      'celilo_contract: "1.0"\nid: testmod\nname: Test Module\nversion: 1.0.0\ndescription: fixture\n',
+      'celilo_contract: "2.0"\nid: testmod\nname: Test Module\nversion: 1.0.0\ndescription: fixture\n',
     );
 
     db = getDb();
@@ -193,7 +193,7 @@ describe('upgradeOneModule — a failed deploy records the failure in the row (c
         state: 'VERIFIED',
         updatedAt: FROZEN,
         manifestData: {
-          celilo_contract: '1.0',
+          celilo_contract: '2.0',
           id: 'testmod',
           name: 'Test Module',
           version: '1.0.0',
@@ -208,7 +208,7 @@ describe('upgradeOneModule — a failed deploy records the failure in the row (c
     mkdirSync(srcDir, { recursive: true });
     writeFileSync(
       join(srcDir, 'manifest.yml'),
-      'celilo_contract: "1.0"\nid: testmod\nname: Test Module\nversion: 1.0.0\ndescription: fixture v6\n',
+      'celilo_contract: "2.0"\nid: testmod\nname: Test Module\nversion: 1.0.0\ndescription: fixture v6\n',
     );
     const pkgPath = join(tempDir, 'testmod-1.0.0.netapp');
     await tarCreate({ file: pkgPath, cwd: srcDir }, ['manifest.yml']);

package/src/cli/commands/module-upgrade.ts

@@ -194,6 +194,18 @@ export async function upgradeOneModule(
     const blockers = capabilityBlockersForManifest(db, targetManifestCheck.manifest);
     if (blockers.length > 0) {
       const why = blockers.map((b) => b.message).join('; ');
+      // A provider AHEAD of what the consumer requires is TERMINAL (celilo#1414):
+      // no retry can fix it, the consumer's source must move to the provider's
+      // current major and republish. Only a provider BEHIND (major_mismatch_higher,
+      // the celilo#1361 case) is transient. Deferring the terminal case retried it
+      // forever, reported success, and left four consumers silently stuck.
+      if (blockers.every((b) => b.reason === 'major_mismatch_lower')) {
+        return {
+          success: false,
+          error: `${moduleId} upgrade to ${targetVersion} cannot proceed: the deployed providers are AHEAD of its capability requirements: ${why}. This will not resolve on retry — update ${moduleId}'s source to the provider's current major and republish it.`,
+          details: blockers,
+        };
+      }
       return {
         success: false,
         deferred: true,

package/src/cli/commands/module-version.test.ts

@@ -8,7 +8,7 @@ let dir: string;
 
 const MANIFEST = (kind: string | null) =>
   [
-    'celilo_contract: "1.0"',
+    'celilo_contract: "2.0"',
     'id: lunacycle',
     'name: LunaCycle',
     'version: 1.0.1   # keep this comment',

package/src/cli/commands/system-audit.ts

@@ -26,6 +26,7 @@ import { testProxmoxConnection } from '../../api-clients/proxmox';
 import { getDb } from '../../db/client';
 import {
   capabilitySecrets,
+  machines,
   moduleConfigs as moduleConfigsTbl,
   modules,
   secrets,
@@ -52,6 +53,7 @@ import {
 } from '../../services/audit/public-dns-source';
 import { makeJournalReader, readAppliedMigrations } from '../../services/audit/schema';
 import type { SecretCheckResult } from '../../services/audit/secrets-decryptable';
+import { collectServerBunPinDeps } from '../../services/audit/server-bun-pin';
 import type { ServiceCredentialsResult } from '../../services/audit/services-credentials';
 import type { ServiceReachableResult } from '../../services/audit/services-reachable';
 import type { TerraformPlanRunner } from '../../services/audit/terraform-plan';
@@ -63,6 +65,7 @@ import { collectJailExemptions } from '../../services/jail-exemptions';
 import { probeMachines } from '../../services/machine-probe';
 import { parseStoredConfigValue } from '../../services/module-config';
 import { createPublicDnsProbe, loadPublicDnsProbeSettings } from '../../services/public-dns-probe';
+import { collectRebootPendingDeps } from '../../services/system-reboot';
 import { buildTerraformEnvForModule } from '../../services/terraform-env';
 import { hasFlag } from '../parser';
 import type { CommandResult } from '../types';
@@ -368,6 +371,22 @@ async function buildAuditDeps(
     probeDiskUsage(db),
   ]);
 
+  // Stale interface zone labels. Reads only what is already stored — the
+  // detector matches an address against the declared subnets, so this costs
+  // no SSH and cannot be confused by an unreachable machine.
+  const { diffInterfaceZones } = await import('../../services/machine-interface-zones');
+  const { detectZoneFromIp } = await import('../../services/zone-detector');
+  const machineZoneLabels = await Promise.all(
+    db
+      .select()
+      .from(machines)
+      .all()
+      .map(async (m) => ({
+        hostname: m.hostname,
+        changes: await diffInterfaceZones(m.interfaces, detectZoneFromIp),
+      })),
+  );
+
   const migrationsFolder = findMigrationsFolderSafe();
 
   return {
@@ -388,6 +407,8 @@ async function buildAuditDeps(
       })),
     },
     browserPin: collectBrowserPinDeps(deployedModules),
+    serverBunPin: collectServerBunPinDeps(),
+    rebootPending: collectRebootPendingDeps(),
     terraformPlan: {
       modules: terraformModules,
       run: realTerraformPlan,
@@ -429,6 +450,7 @@ async function buildAuditDeps(
     secretsDecryptable: { results: secretResults },
     servicesReachable: { results: serviceReachableResults },
     machinesReachable: { results: machineReachableResults },
+    machineInterfaceZones: { machines: machineZoneLabels },
     // The only check here whose vantage point is OUTSIDE the fleet. Its
     // undetermined counters are read but not written from this path: an
     // operator-run audit is not a run of a schedule, so counting it towards