@celilo/core 0.3.2 → 0.4.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@celilo/core",
-  "version": "0.3.2",
+  "version": "0.4.0",
   "description": "Lightweight shared core for Celilo CLI tools — command registry, NDJSON API protocol, and remote SSH client. No Ink/React/drizzle/aws-sdk transitive deps, so an MCP server can reach the transport without installing the full CLI.",
   "type": "module",
   "main": "./src/index.ts",

package/src/command-registry.ts

@@ -306,6 +306,12 @@ export const COMMANDS: CommandDef[] = [
         description: 'Remove the installed supervisor unit',
         flags: [{ name: 'system', description: 'Target the system-scope unit', takesValue: false }],
       },
+      {
+        name: 'restart-daemon',
+        description:
+          'Restart the dispatcher through its supervisor, stopping any unsupervised one, and verify the new process reports the installed code version',
+        flags: [{ name: 'system', description: 'Target the system-scope unit', takesValue: false }],
+      },
       {
         name: 'show-daemon',
         description: 'Print the currently installed unit file',
@@ -1218,6 +1224,14 @@ export const COMMANDS: CommandDef[] = [
       {
         name: 'migrate',
         description: 'Apply pending database migrations (idempotent; safe to re-run)',
+        flags: [
+          {
+            name: 'status',
+            description:
+              'Report applied count, latest applied migration and pending ones by name without applying anything',
+            takesValue: false,
+          },
+        ],
       },
       {
         name: 'doctor',

package/src/protocol.ts

@@ -23,11 +23,19 @@ export const CommandMessageSchema = z.object({
 });
 export type CommandMessage = z.infer<typeof CommandMessageSchema>;
 
-/** Client's answer to a server `interview` message, correlated by `id`. */
+/**
+ * Client's answer to a server `interview` message, correlated by `id`.
+ *
+ * `error` is the "I cannot answer this" reply: the client had no way to reach a
+ * decider (no TTY, no pre-staged answer). The server fails the waiting command
+ * with that message instead of it resolving to the question's `defaultValue` —
+ * an unanswered question must never become a silent "no".
+ */
 export const AnswerMessageSchema = z.object({
   type: z.literal('answer'),
   id: z.string(),
   value: z.unknown(),
+  error: z.string().optional(),
 });
 export type AnswerMessage = z.infer<typeof AnswerMessageSchema>;
 
@@ -91,6 +99,14 @@ export type ErrorMessage = z.infer<typeof ErrorMessageSchema>;
 export const InterviewMessageSchema = z.object({
   type: z.literal('interview'),
   id: z.string(),
+  /**
+   * The question's stable identity (`interview.required.<scope>.<key>`). A
+   * client can pre-stage an answer under `<scope>.<key>` — the same lookup key
+   * `celilo events respond --values` uses. Optional so a client still parses
+   * messages from an older server that didn't send them.
+   */
+  scope: z.string().optional(),
+  key: z.string().optional(),
   kind: z.enum(['text', 'confirm', 'select', 'multiselect']),
   message: z.string(),
   description: z.string().optional(),

package/src/remote-client.ts

@@ -16,8 +16,41 @@ import { type InterviewMessage, type ServerMessage, ServerMessageSchema } from '
 
 const REMOTE_FLAG = '--remote';
 
-/** Render a forwarded interview via clack, returning the operator's answer. */
+/** Stable `<scope>.<key>` identity for a forwarded question, when the server sent one. */
+export function interviewKey(iv: InterviewMessage): string | null {
+  return iv.scope && iv.key ? `${iv.scope}.${iv.key}` : null;
+}
+
+/**
+ * Thrown by a renderer that has no way to reach a decider. `runRemoteClient`
+ * turns it into an `answer` carrying `error`, so the server fails the waiting
+ * command loudly rather than the question resolving to its default.
+ */
+export class InterviewUnanswerableError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = 'InterviewUnanswerableError';
+  }
+}
+
+/**
+ * Render a forwarded interview via clack, returning the operator's answer.
+ *
+ * Refuses to prompt when stdin isn't a TTY. clack reads keypresses off stdin
+ * whether or not it is a terminal, so on a piped stdin (an MCP server's
+ * JSON-RPC stream, a CI harness) the very next newline submits the prompt at
+ * its `initialValue` — i.e. the question's `defaultValue` — and the answer
+ * looks exactly like a considered human decision. That is how a live rollout
+ * came to report "operator declined" for a breaking update nobody was asked
+ * about. A client with no terminal must say so instead of guessing.
+ */
 async function defaultRenderInterview(iv: InterviewMessage): Promise<unknown> {
+  if (!process.stdin.isTTY) {
+    const key = interviewKey(iv);
+    throw new InterviewUnanswerableError(
+      `Cannot answer "${iv.message}"${key ? ` (${key})` : ''}: stdin isn't a terminal and no answer was pre-staged.`,
+    );
+  }
   const options = (iv.options ?? []).map((o) => ({ value: o.value, label: o.label, hint: o.hint }));
   let result: unknown;
   switch (iv.kind) {
@@ -193,8 +226,20 @@ export async function runRemoteClient(
       }
 
       if (msg.type === 'interview') {
-        const value = await renderInterview(msg);
-        transport.stdin.write(`${JSON.stringify({ type: 'answer', id: msg.id, value })}\n`);
+        let answer: { type: 'answer'; id: string; value: unknown; error?: string };
+        try {
+          answer = { type: 'answer', id: msg.id, value: await renderInterview(msg) };
+        } catch (err) {
+          // Never fabricate an answer: tell the server we can't decide, and let
+          // it fail the waiting command with this message.
+          answer = {
+            type: 'answer',
+            id: msg.id,
+            value: null,
+            error: err instanceof Error ? err.message : String(err),
+          };
+        }
+        transport.stdin.write(`${JSON.stringify(answer)}\n`);
         await transport.stdin.flush?.();
         continue;
       }