@celilo/cli 4.1.0 → 5.0.1

package/src/cli/commands/module-generate.test.ts

@@ -9,7 +9,7 @@ const DECLARED = join('ansible', 'roles', 'fixture', 'files', 'binary');
 
 function manifestWithArtifacts(artifacts: string[]): ModuleManifest {
   return {
-    celilo_contract: '1.0',
+    celilo_contract: '2.0',
     id: 'fixture',
     name: 'Fixture',
     version: '1.0.0',
@@ -42,7 +42,7 @@ describe('missingBuildOutputs', () => {
   test('reports nothing for a module with no build block', () => {
     expect(
       missingBuildOutputs(payload, {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'fixture',
         name: 'Fixture',
         version: '1.0.0',

package/src/cli/commands/module-import-aspect.test.ts

@@ -32,7 +32,7 @@ function insertAspectModule(id: string, version: string): void {
         id,
         name: id,
         version,
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         base_module_aspect: aspect,
       },
       sourcePath: `/tmp/${id}`,
@@ -102,7 +102,7 @@ describe('handleAspectApprovalAfterImport (non-interactive)', () => {
         id: 'caddy',
         name: 'caddy',
         version: '1.0.0',
-        manifestData: { id: 'caddy', name: 'caddy', version: '1.0.0', celilo_contract: '1.0' },
+        manifestData: { id: 'caddy', name: 'caddy', version: '1.0.0', celilo_contract: '2.0' },
         sourcePath: '/tmp/caddy',
       })
       .run();

package/src/cli/commands/module-update.test.ts

@@ -95,7 +95,7 @@ describe('updateOne — displayVersion and quiet', () => {
     mkdirSync(srcDir, { recursive: true });
     writeFileSync(
       join(srcDir, 'manifest.yml'),
-      `celilo_contract: "1.0"
+      `celilo_contract: "2.0"
 id: testmod
 name: Test Module
 version: 1.0.0
@@ -117,7 +117,7 @@ description: fixture
         version: '1.0.0+5',
         updatedAt: new Date('2026-04-25T16:26:31Z'),
         manifestData: {
-          celilo_contract: '1.0',
+          celilo_contract: '2.0',
           id: 'testmod',
           name: 'Test Module',
           version: '1.0.0',
@@ -195,7 +195,7 @@ description: fixture
     // row's manifestData should reflect the removal.
     writeFileSync(
       join(srcDir, 'manifest.yml'),
-      `celilo_contract: "1.0"
+      `celilo_contract: "2.0"
 id: testmod
 name: Test Module Renamed
 version: 2.0.0
@@ -210,7 +210,7 @@ variables:
     db.update(modules)
       .set({
         manifestData: {
-          celilo_contract: '1.0',
+          celilo_contract: '2.0',
           id: 'testmod',
           name: 'Test Module',
           version: '1.0.0',
@@ -249,7 +249,7 @@ variables:
     try {
       writeFileSync(
         join(srcDir, 'manifest.yml'),
-        `celilo_contract: "1.0"
+        `celilo_contract: "2.0"
 id: testmod
 name: Test Module
 version: 1.1.0
@@ -302,7 +302,7 @@ describe('registry sweep — an unanswered breaking update is not a decline', ()
         sourcePath: join(tempDir, 'installed'),
         version: '1.0.2+9',
         manifestData: {
-          celilo_contract: '1.0',
+          celilo_contract: '2.0',
           id: 'iptables',
           name: 'iptables',
           version: '1.0.2',
@@ -376,7 +376,7 @@ describe("updateOne — pointed at the module's own installed path", () => {
     mkdirSync(installedDir, { recursive: true });
     writeFileSync(
       join(installedDir, 'manifest.yml'),
-      `celilo_contract: "1.0"
+      `celilo_contract: "2.0"
 id: selfmod
 name: Self Module
 version: 1.0.0
@@ -392,7 +392,7 @@ description: fixture
         sourcePath: installedDir,
         version: '1.0.0',
         manifestData: {
-          celilo_contract: '1.0',
+          celilo_contract: '2.0',
           id: 'selfmod',
           name: 'Self Module',
           version: '1.0.0',
@@ -480,7 +480,7 @@ describe('updateOne — an update that fails partway leaves the install untouche
     mkdirSync(join(installedDir, 'generated'), { recursive: true });
     writeFileSync(
       join(installedDir, 'manifest.yml'),
-      'celilo_contract: "1.0"\nid: testmod\nname: Test Module\nversion: 1.0.0\ndescription: fixture\n',
+      'celilo_contract: "2.0"\nid: testmod\nname: Test Module\nversion: 1.0.0\ndescription: fixture\n',
     );
     writeFileSync(join(installedDir, 'scripts', 'on_install.ts'), 'export const OLD = 1;\n');
     // `derived` — celilo's own output, must survive an update either way.
@@ -490,7 +490,7 @@ describe('updateOne — an update that fails partway leaves the install untouche
     mkdirSync(join(srcDir, 'scripts'), { recursive: true });
     writeFileSync(
       join(srcDir, 'manifest.yml'),
-      'celilo_contract: "1.0"\nid: testmod\nname: Test Module\nversion: 2.0.0\ndescription: fixture\n',
+      'celilo_contract: "2.0"\nid: testmod\nname: Test Module\nversion: 2.0.0\ndescription: fixture\n',
     );
     writeFileSync(join(srcDir, 'scripts', 'on_install.ts'), 'export const NEW = 2;\n');
     // cpSync refuses a FIFO with ENOTSUP. Sorts last, so the real files copy first.
@@ -504,7 +504,7 @@ describe('updateOne — an update that fails partway leaves the install untouche
         sourcePath: installedDir,
         version: '1.0.0',
         manifestData: {
-          celilo_contract: '1.0',
+          celilo_contract: '2.0',
           id: 'testmod',
           name: 'Test Module',
           version: '1.0.0',
@@ -588,7 +588,7 @@ describe('updateOne — a .netapp package source', () => {
     mkdirSync(installedDir, { recursive: true });
     writeFileSync(
       join(installedDir, 'manifest.yml'),
-      'celilo_contract: "1.0"\nid: testmod\nname: Test Module\nversion: 1.0.0\ndescription: fixture\n',
+      'celilo_contract: "2.0"\nid: testmod\nname: Test Module\nversion: 1.0.0\ndescription: fixture\n',
     );
 
     db = getDb();
@@ -599,7 +599,7 @@ describe('updateOne — a .netapp package source', () => {
         sourcePath: installedDir,
         version: '1.0.0+5',
         manifestData: {
-          celilo_contract: '1.0',
+          celilo_contract: '2.0',
           id: 'testmod',
           name: 'Test Module',
           version: '1.0.0',
@@ -626,7 +626,7 @@ describe('updateOne — a .netapp package source', () => {
     mkdirSync(srcDir, { recursive: true });
     writeFileSync(
       join(srcDir, 'manifest.yml'),
-      'celilo_contract: "1.0"\nid: testmod\nname: Test Module\nversion: 2.0.0\ndescription: fixture v2\n',
+      'celilo_contract: "2.0"\nid: testmod\nname: Test Module\nversion: 2.0.0\ndescription: fixture v2\n',
     );
     const pkgPath = join(tempDir, 'testmod-2.0.0.netapp');
     await tarCreate({ file: pkgPath, cwd: srcDir }, ['manifest.yml']);

package/src/cli/commands/module-upgrade-gate.test.ts

@@ -45,7 +45,7 @@ async function packageWithManifest(manifestYaml: string): Promise<ArrayBuffer> {
 }
 
 const MANIFEST = (publicWebVersion: string) => `
-celilo_contract: "1.0"
+celilo_contract: "2.0"
 id: celilo-website
 name: Celilo Website
 version: 2.0.0
@@ -152,3 +152,28 @@ describe('handleModuleUpgrade — the capability gate (celilo#1361)', () => {
     }
   });
 });
+
+describe('handleModuleUpgrade — provider AHEAD is terminal (celilo#1414)', () => {
+  test('fails, does not defer, when every blocker is major_mismatch_lower', async () => {
+    // Consumer requires public_web@3.1.0; the deployed caddy serves 4.0.0.
+    // No retry can fix that — the consumer's source has to move.
+    seedFleet('4.0.0');
+    downloadSpy.mockImplementation(async () => packageWithManifest(MANIFEST('3.1.0')));
+
+    const result = await handleModuleUpgrade(['celilo-website'], {});
+
+    expect(result.success).toBe(false);
+    if (!result.success) {
+      expect(result.deferred).toBeUndefined();
+      expect(result.error).not.toContain('retries automatically');
+      expect(result.error).toContain('public_web');
+    }
+    // Still no state change: a terminal blocker must not record the version.
+    const row = getDb()
+      .select()
+      .from(modules)
+      .all()
+      .find((m) => m.id === 'celilo-website');
+    expect(row?.version).toBe('1.0.5');
+  });
+});

package/src/cli/commands/module-upgrade.test.ts

@@ -180,7 +180,7 @@ describe('upgradeOneModule — a failed deploy records the failure in the row (c
     mkdirSync(installedDir, { recursive: true });
     writeFileSync(
       join(installedDir, 'manifest.yml'),
-      'celilo_contract: "1.0"\nid: testmod\nname: Test Module\nversion: 1.0.0\ndescription: fixture\n',
+      'celilo_contract: "2.0"\nid: testmod\nname: Test Module\nversion: 1.0.0\ndescription: fixture\n',
     );
 
     db = getDb();
@@ -193,7 +193,7 @@ describe('upgradeOneModule — a failed deploy records the failure in the row (c
         state: 'VERIFIED',
         updatedAt: FROZEN,
         manifestData: {
-          celilo_contract: '1.0',
+          celilo_contract: '2.0',
           id: 'testmod',
           name: 'Test Module',
           version: '1.0.0',
@@ -208,7 +208,7 @@ describe('upgradeOneModule — a failed deploy records the failure in the row (c
     mkdirSync(srcDir, { recursive: true });
     writeFileSync(
       join(srcDir, 'manifest.yml'),
-      'celilo_contract: "1.0"\nid: testmod\nname: Test Module\nversion: 1.0.0\ndescription: fixture v6\n',
+      'celilo_contract: "2.0"\nid: testmod\nname: Test Module\nversion: 1.0.0\ndescription: fixture v6\n',
     );
     const pkgPath = join(tempDir, 'testmod-1.0.0.netapp');
     await tarCreate({ file: pkgPath, cwd: srcDir }, ['manifest.yml']);

package/src/cli/commands/module-upgrade.ts

@@ -194,6 +194,18 @@ export async function upgradeOneModule(
     const blockers = capabilityBlockersForManifest(db, targetManifestCheck.manifest);
     if (blockers.length > 0) {
       const why = blockers.map((b) => b.message).join('; ');
+      // A provider AHEAD of what the consumer requires is TERMINAL (celilo#1414):
+      // no retry can fix it, the consumer's source must move to the provider's
+      // current major and republish. Only a provider BEHIND (major_mismatch_higher,
+      // the celilo#1361 case) is transient. Deferring the terminal case retried it
+      // forever, reported success, and left four consumers silently stuck.
+      if (blockers.every((b) => b.reason === 'major_mismatch_lower')) {
+        return {
+          success: false,
+          error: `${moduleId} upgrade to ${targetVersion} cannot proceed: the deployed providers are AHEAD of its capability requirements: ${why}. This will not resolve on retry — update ${moduleId}'s source to the provider's current major and republish it.`,
+          details: blockers,
+        };
+      }
       return {
         success: false,
         deferred: true,

package/src/cli/commands/module-version.test.ts

@@ -8,7 +8,7 @@ let dir: string;
 
 const MANIFEST = (kind: string | null) =>
   [
-    'celilo_contract: "1.0"',
+    'celilo_contract: "2.0"',
     'id: lunacycle',
     'name: LunaCycle',
     'version: 1.0.1   # keep this comment',

package/src/cli/index.ts

@@ -2578,6 +2578,26 @@ function parseCommand(command: string): string[] {
   return args;
 }
 
+/**
+ * Write to stdout and WAIT for it to reach the far end before returning.
+ *
+ * `process.stdout.write()` followed by `process.exit()` silently drops
+ * everything past the pipe buffer (64 KiB on macOS) whenever stdout is a pipe
+ * rather than a TTY — so `celilo completion zsh > file` was whole while
+ * `GENERATED=$(celilo completion zsh)` lost its tail mid-line, with exit 0 and
+ * no diagnostic anywhere. install-zsh-completion.sh captured exactly that way
+ * and installed a truncated, unparseable `_celilo`.
+ *
+ * Awaiting the stream's own write callback is the whole fix: it fires once the
+ * bytes have been accepted downstream, so the following `process.exit()` can no
+ * longer race the flush.
+ */
+async function writeStdout(text: string): Promise<void> {
+  await new Promise<void>((resolve, reject) => {
+    process.stdout.write(text, (err) => (err ? reject(err) : resolve()));
+  });
+}
+
 async function serverMode(): Promise<void> {
   const readline = await import('node:readline');
 
@@ -2699,7 +2719,7 @@ export async function main(): Promise<void> {
     if (result.success) {
       // For completion mode, output raw text without formatting
       if (process.argv.includes('--get-completions') || process.argv.includes('completion')) {
-        console.log(result.message);
+        await writeStdout(`${result.message}\n`);
         process.exit(0);
       }
 
@@ -2722,7 +2742,7 @@ export async function main(): Promise<void> {
       // `line.startsWith('<module-id> ')` over `celilo module list` match
       // nothing — read in celilo#695 as a missing module rather than as a
       // parse failure, at the cost of a full e2e run.
-      process.stdout.write(`${result.message}\n`);
+      await writeStdout(`${result.message}\n`);
       process.exit(0);
     }
 

package/src/cli/restore-migration-failure.test.ts

@@ -37,7 +37,7 @@ const MODULE_ID = 'restore-migration-test';
 
 /** The manifest the module row carries: one on_restore hook, the fixture. */
 const MODULE_MANIFEST = {
-  celilo_contract: '1.0',
+  celilo_contract: '2.0',
   id: MODULE_ID,
   name: 'Restore Migration Test',
   version: '0.0.1',

package/src/cli/stdout-pipe-flush.test.ts

@@ -0,0 +1,35 @@
+import { describe, expect, test } from 'bun:test';
+
+// `process.stdout.write()` followed by `process.exit()` drops everything past
+// the 64 KiB OS pipe buffer when stdout is a pipe. The zsh completion script is
+// the CLI's largest stdout payload (~70 KB), so it is the cheapest witness.
+//
+// The capture has to go through a real shell: a Bun.spawn pipe is not an OS
+// pipe and never truncates, so a test written that way passes with the defect
+// present. `$(...)` is how install-zsh-completion.sh reads the generator, and
+// it read 65536 bytes of a 70092-byte script — exit 0, no diagnostic, and a
+// `_celilo` cut off mid-line installed into the operator's fpath.
+//
+// The invariant is that a capture and a redirect of the same command agree to
+// within the trailing newlines `$(...)` strips. Both are measured in the same
+// shell, so nothing here depends on the generator's exact size.
+describe('CLI stdout survives an OS pipe', () => {
+  test('completion zsh is captured whole, not truncated at 64 KiB', async () => {
+    const cli = `bun run ${import.meta.dir}/index.ts completion zsh`;
+    const proc = Bun.spawn(
+      [
+        'bash',
+        '-c',
+        `f=$(mktemp); ${cli} > "$f"; out=$(${cli}); printf %s "$out" | wc -c; wc -c < "$f"; rm -f "$f"`,
+      ],
+      { stdout: 'pipe', stderr: 'ignore' },
+    );
+    const [captured, redirected] = (await new Response(proc.stdout).text())
+      .trim()
+      .split('\n')
+      .map((n) => Number(n.trim()));
+
+    expect(redirected).toBeGreaterThan(65536); // below the buffer this proves nothing
+    expect(redirected - captured).toBeLessThanOrEqual(2); // only stripped newlines
+  }, 60_000);
+});

package/src/db/private-routes.test.ts

@@ -0,0 +1,159 @@
+/**
+ * `private_routes` — the internal ingress's own declared rows (slice 2 of
+ * providers-converge-declared-state, task 2.1).
+ *
+ * Same shape as `web_routes`, separate table on purpose. caddy derives the
+ * hostnames it SERVES from every row of `web_routes`, so a private route stored
+ * there would be picked up and served by the PUBLIC ingress — the exact leak
+ * caddy-internal exists to prevent (celilo#846). The isolation is therefore a
+ * property worth asserting rather than assuming: a table boundary is only as
+ * good as the queries that respect it.
+ */
+
+import { afterEach, beforeEach, describe, expect, test } from 'bun:test';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { eq } from 'drizzle-orm';
+import { setupTestDatabaseAt } from '../test-utils/database';
+import { resetTestDbPath } from '../test-utils/db-path';
+import type { DbClient } from './client';
+import { modules, privateRoutes, webRoutes } from './schema';
+
+describe('private_routes', () => {
+  let dir: string;
+  let db: DbClient;
+
+  beforeEach(async () => {
+    dir = mkdtempSync(join(tmpdir(), 'private-routes-'));
+    const dbPath = join(dir, 'celilo.db');
+    process.env.CELILO_DB_PATH = dbPath;
+    db = await setupTestDatabaseAt(dbPath);
+
+    for (const id of ['wireguard-manager', 'hello-foo']) {
+      db.insert(modules)
+        .values({
+          id,
+          name: id,
+          version: '1.0.0',
+          manifestData: {},
+          sourcePath: join(dir, 'modules', id),
+          state: 'VERIFIED',
+        })
+        .onConflictDoNothing()
+        .run();
+    }
+  });
+
+  afterEach(() => {
+    db.$client.close();
+    resetTestDbPath();
+    try {
+      rmSync(dir, { recursive: true, force: true });
+    } catch {
+      /* ignore */
+    }
+  });
+
+  function insertPrivate(overrides: Record<string, unknown> = {}) {
+    db.insert(privateRoutes)
+      .values({
+        slug: 'vpn-manager',
+        moduleId: 'wireguard-manager',
+        type: 'reverse_proxy',
+        path: '/',
+        hostname: 'vpn-manager.celilo.computer',
+        targetHost: '10.0.20.15',
+        targetPort: 3000,
+        websocket: false,
+        ...overrides,
+      })
+      .run();
+  }
+
+  test('carries web_routes columns, so one renderer shape serves both', () => {
+    insertPrivate();
+    const row = db.select().from(privateRoutes).get();
+
+    // Named individually rather than compared as a set: the point is that a
+    // renderer written against WebRoute reads this row unchanged.
+    expect(row?.slug).toBe('vpn-manager');
+    expect(row?.moduleId).toBe('wireguard-manager');
+    expect(row?.type).toBe('reverse_proxy');
+    expect(row?.path).toBe('/');
+    expect(row?.hostname).toBe('vpn-manager.celilo.computer');
+    expect(row?.targetHost).toBe('10.0.20.15');
+    expect(row?.targetPort).toBe(3000);
+    expect(row?.websocket).toBe(false);
+    expect(row?.contentHash ?? null).toBeNull();
+    expect(row?.createdAt).toBeInstanceOf(Date);
+    expect(row?.updatedAt).toBeInstanceOf(Date);
+  });
+
+  test('a private route is unreachable from the public provider query (celilo#846)', () => {
+    insertPrivate();
+
+    // This is the query the public provider runs — buildRouteOps.getAllRoutes,
+    // which caddy's renderer turns into served hostnames. It must not see a
+    // private row, or the private hostname gets a public site block and a
+    // public certificate.
+    const publicRows = db.select().from(webRoutes).all();
+    expect(publicRows).toEqual([]);
+
+    // And the converse, so the assertion cannot pass merely because nothing
+    // was written anywhere.
+    expect(db.select().from(privateRoutes).all()).toHaveLength(1);
+  });
+
+  test('a public and a private route may share a hostname and path without colliding', () => {
+    // Separate tables means separate unique indexes. Same name served by both
+    // ingresses is a legitimate split-horizon arrangement, and a shared table
+    // would have rejected the second row.
+    insertPrivate({ hostname: 'shared.celilo.computer' });
+    db.insert(webRoutes)
+      .values({
+        slug: 'shared',
+        moduleId: 'hello-foo',
+        type: 'reverse_proxy',
+        path: '/',
+        hostname: 'shared.celilo.computer',
+        targetHost: '10.0.10.9',
+        targetPort: 8080,
+        websocket: false,
+      })
+      .run();
+
+    expect(db.select().from(privateRoutes).all()).toHaveLength(1);
+    expect(db.select().from(webRoutes).all()).toHaveLength(1);
+  });
+
+  test('uniqueness is scoped to (hostname, path), as web_routes is', () => {
+    insertPrivate();
+    expect(() => insertPrivate({ moduleId: 'hello-foo', slug: 'other' })).toThrow();
+  });
+
+  test('removing the consumer removes its routes (consumer cascade)', () => {
+    insertPrivate();
+    db.insert(privateRoutes)
+      .values({
+        slug: 'other',
+        moduleId: 'hello-foo',
+        type: 'reverse_proxy',
+        path: '/other',
+        hostname: 'vpn-manager.celilo.computer',
+        targetHost: '10.0.20.16',
+        targetPort: 3000,
+        websocket: false,
+      })
+      .run();
+
+    db.delete(modules).where(eq(modules.id, 'wireguard-manager')).run();
+
+    // The departing consumer's row goes; the other consumer's stays. A private
+    // route outliving its module would render a site block pointing at a
+    // backend nothing owns.
+    const left = db.select().from(privateRoutes).all();
+    expect(left).toHaveLength(1);
+    expect(left[0]?.moduleId).toBe('hello-foo');
+  });
+});

package/src/db/schema.ts

@@ -816,6 +816,55 @@ export const webRoutes = sqliteTable(
   }),
 );
 
+/**
+ * Private-route registry — the desired-state store for the `private_web`
+ * capability (openspec/changes/providers-converge-declared-state, slice 2).
+ *
+ * `web_routes`' columns, its own table. The shape is shared so ONE renderer
+ * shape serves both ingresses and the plumbing around them is the same
+ * (design D1); the table is separate because the PUBLIC provider derives the
+ * hostnames it serves from every row of `web_routes`, so a private route
+ * stored there would be picked up and served publicly — the exact leak
+ * caddy-internal exists to prevent (celilo#846). Two tables is what makes that
+ * impossible rather than merely intended.
+ *
+ * This replaces caddy-internal's `routes` module-config key, which held the
+ * same rows as module business inside one module's config. No data migration
+ * (design D9): the table starts empty, and when caddy-internal deploys,
+ * provider arrival re-registers its consumers, whose hooks write their routes
+ * into it inside that same deploy.
+ * @owner capability:private_web — one row is one route on the internal ingress
+ */
+export const privateRoutes = sqliteTable(
+  'private_routes',
+  {
+    id: integer('id').primaryKey({ autoIncrement: true }),
+    slug: text('slug').notNull(),
+    moduleId: text('module_id')
+      .notNull()
+      .references(() => modules.id, { onDelete: 'cascade' }),
+    type: text('type').$type<'static' | 'reverse_proxy'>().notNull(),
+    path: text('path').notNull(),
+    /** FQDN this route serves under, in the INTERNAL DNS view only. */
+    hostname: text('hostname').notNull(),
+    targetHost: text('target_host'),
+    targetPort: integer('target_port'),
+    websocket: integer('websocket', { mode: 'boolean' }).notNull().default(false),
+    contentHash: text('content_hash'),
+    createdAt: integer('created_at', { mode: 'timestamp' }).notNull().default(sql`(unixepoch())`),
+    updatedAt: integer('updated_at', { mode: 'timestamp' }).notNull().default(sql`(unixepoch())`),
+  },
+  (table) => ({
+    // Scoped to hostname exactly as web_routes is, and scoped to THIS table:
+    // the same hostname and path may exist on both ingresses, which is a
+    // legitimate split-horizon arrangement.
+    hostnamePathUnique: uniqueIndex('private_routes_hostname_path_idx').on(
+      table.hostname,
+      table.path,
+    ),
+  }),
+);
+
 /**
  * Port-forward registry — the desired-state store for the `firewall` capability
  * (openspec/changes/unified-management-no-ssh/proposal.md). One row per exposed forward. `exposeService`