@celilo/core 0.11.0 → 0.12.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@celilo/core",
-  "version": "0.11.0",
+  "version": "0.12.0",
   "description": "Lightweight shared core for Celilo CLI tools — command registry, NDJSON API protocol, and remote SSH client. No Ink/React/drizzle/aws-sdk transitive deps, so an MCP server can reach the transport without installing the full CLI.",
   "type": "module",
   "main": "./src/index.ts",

package/src/command-registry.ts

@@ -742,6 +742,33 @@ export const COMMANDS: CommandDef[] = [
           },
         ],
       },
+      {
+        name: 'jail',
+        description:
+          "Get or set one module's hook jail policy (auto|off|required). Omit the policy to show the effective value and which source produced it; --clear removes the row so the module follows the system's hooks.jail_policy again",
+        args: [
+          { name: 'id', description: 'Module ID', completion: 'module_ids' },
+          {
+            name: 'policy',
+            description:
+              'auto (jail when a backend is available), off (never jail), or required (an unavailable jail is a hard failure); omit to show the effective policy',
+          },
+        ],
+        flags: [
+          {
+            name: 'clear',
+            description:
+              "Remove the module's recorded policy so it follows the system's hooks.jail_policy again",
+            takesValue: false,
+          },
+          {
+            name: 'force',
+            description:
+              'Skip the confirmation interview when the new policy is weaker than the system-wide one',
+            takesValue: false,
+          },
+        ],
+      },
       {
         name: 'secret',
         description: 'Manage module secrets',
@@ -813,6 +840,12 @@ export const COMMANDS: CommandDef[] = [
               'Exit cleanly after the initial config + secrets interview (no terraform/ansible/hooks). Manual validation of the bus-mediated interview path.',
             takesValue: false,
           },
+          {
+            name: 'keep',
+            description:
+              'Retain the generated project after a successful deploy (it is deleted by design)',
+            takesValue: false,
+          },
         ],
       },
       {
@@ -820,6 +853,50 @@ export const COMMANDS: CommandDef[] = [
         description: 'Pre-flight check: validate module is ready for deployment',
         args: [{ name: 'id', description: 'Module ID', completion: 'module_ids' }],
       },
+      {
+        name: 'check',
+        description: 'Run drift-detection checks against a third-party module directory',
+        args: [{ name: 'path', description: 'Module directory (defaults to ".")' }],
+        flags: [
+          {
+            name: 'no-build',
+            description: 'Skip `bunx tsc --noEmit` (fast iteration, or no TypeScript surface)',
+            takesValue: false,
+          },
+          {
+            name: 'json',
+            description: 'Emit the structured Check[] payload instead of formatted text',
+            takesValue: false,
+          },
+          {
+            name: 'strict',
+            description: 'Treat warnings as failures (any non-OK is a non-zero exit)',
+            takesValue: false,
+          },
+        ],
+      },
+      {
+        name: 'changeset',
+        description: 'Author a version changeset for a module (.changeset/<name>.md)',
+        args: [{ name: 'module-dir', description: 'Module directory (defaults to ".")' }],
+        flags: [
+          {
+            name: 'bump',
+            description: 'Version bump type: major, minor or patch (required)',
+            takesValue: true,
+          },
+          {
+            name: 'message',
+            description: 'Changeset body text (default: "<bump> change to <module-id>.")',
+            takesValue: true,
+          },
+          {
+            name: 'name',
+            description: 'Changeset filename stem (default: auto-generated slug)',
+            takesValue: true,
+          },
+        ],
+      },
       {
         name: 'status',
         description: 'Show detailed module status',
@@ -1207,6 +1284,7 @@ export const COMMANDS: CommandDef[] = [
             takesValue: true,
             valueHint: 'dmz app secure internal external',
           },
+          { name: 'json', description: 'Machine-readable JSON output', takesValue: false },
         ],
       },
       {
@@ -1294,6 +1372,18 @@ export const COMMANDS: CommandDef[] = [
               { name: 'key', description: 'Config key', completion: 'system_config_keys' },
               { name: 'value', description: 'Config value' },
             ],
+            // `handleSystemConfigSet` has honoured `flags.force` since the
+            // hooks.jail_policy interview gate landed, and its unit test drives
+            // the handler directly, so the flag was tested and unreachable:
+            // the parser rejected `--force` with "does not accept any flags".
+            flags: [
+              {
+                name: 'force',
+                description:
+                  'Skip the confirmation interview for values that change security posture (hooks.jail_policy off)',
+                takesValue: false,
+              },
+            ],
           },
           {
             name: 'get',
@@ -1396,6 +1486,12 @@ export const COMMANDS: CommandDef[] = [
         description:
           'Diagnose system prerequisites, @celilo/* version drift, and (on a management plane) fleet-runtime drift',
         flags: [
+          {
+            name: 'deep',
+            description:
+              'Also measure the host plane: one SSH per system for module integrity, plus aspect coverage (celilo#1308: the doctor prescribed --deep before the registry declared it)',
+            takesValue: false,
+          },
           {
             name: 'fix',
             description: