@celilo/core 0.5.0 → 0.7.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@celilo/core",
-  "version": "0.5.0",
+  "version": "0.7.0",
   "description": "Lightweight shared core for Celilo CLI tools — command registry, NDJSON API protocol, and remote SSH client. No Ink/React/drizzle/aws-sdk transitive deps, so an MCP server can reach the transport without installing the full CLI.",
   "type": "module",
   "main": "./src/index.ts",
@@ -24,8 +24,7 @@
     "directory": "packages/core"
   },
   "dependencies": {
-    "@celilo/cli-display": "^0.1.10",
-    "@clack/prompts": "^1.1.0",
+    "@celilo/cli-display": "^0.2.0",
     "zod": "^3.24.1"
   }
 }

package/src/command-registry.ts

@@ -168,6 +168,18 @@ export const COMMANDS: CommandDef[] = [
           { name: 'limit', description: 'Max rows to return', takesValue: true },
         ],
       },
+      {
+        name: 'list-failed',
+        description: 'List failed/abandoned deliveries with a true total',
+        flags: [
+          {
+            name: 'subscriber',
+            description: 'Restrict to a subscriber by name',
+            takesValue: true,
+          },
+          { name: 'limit', description: 'Max rows to return', takesValue: true },
+        ],
+      },
       {
         name: 'list-unanswered',
         description: 'List interview questions nobody has answered yet',
@@ -569,6 +581,62 @@ export const COMMANDS: CommandDef[] = [
           },
         ],
       },
+      {
+        name: 'pause',
+        description:
+          "Take a module out of celilo's control plane without uninstalling it (keeps running unless --stop-infra)",
+        args: [{ name: 'id', description: 'Module ID', completion: 'module_ids' }],
+        flags: [
+          {
+            name: 'cascade',
+            description: 'Also pause every module that depends on it, consumers first',
+            takesValue: false,
+          },
+          {
+            name: 'stop-infra',
+            description: "Also stop the module's container or service",
+            takesValue: false,
+          },
+          {
+            name: 'reason',
+            description: 'Why the pause was taken, recorded on the module',
+            takesValue: true,
+          },
+          {
+            name: 'dry-run',
+            description: 'Print the ordered plan and change nothing',
+            takesValue: false,
+          },
+          {
+            name: 'yes',
+            description: 'Skip the cascade confirmation',
+            takesValue: false,
+          },
+        ],
+      },
+      {
+        name: 'unpause',
+        description:
+          'Return a paused module to service by redeploying it, rebinding it to the providers present now',
+        args: [{ name: 'id', description: 'Module ID', completion: 'module_ids' }],
+        flags: [
+          {
+            name: 'cascade',
+            description: 'Also unpause everything that depends on it, providers first',
+            takesValue: false,
+          },
+          {
+            name: 'dry-run',
+            description: 'Print the ordered plan and change nothing',
+            takesValue: false,
+          },
+          {
+            name: 'yes',
+            description: 'Skip the cascade confirmation',
+            takesValue: false,
+          },
+        ],
+      },
       {
         name: 'update',
         description:

package/src/protocol.ts

@@ -108,6 +108,20 @@ export const ResultMessageSchema = z.object({
   type: z.literal('result'),
   success: z.boolean(),
   exitCode: z.number(),
+  /**
+   * Fleet-level conditions the operator should know about, regardless of what
+   * they ran. Today that is exactly one thing: modules are paused
+   * (openspec/changes/module-pause-lifecycle, design D7).
+   *
+   * Attached to EVERY result, including commands unrelated to the paused
+   * modules, and that is the point — a pause switches off the alerting that
+   * would otherwise report those modules as down, so the only remaining defence
+   * is that the paused-ness is discovered incidentally, while doing something
+   * else. A warning the operator has to go looking for does not do that job.
+   *
+   * Optional so an older client parses a newer server's result unchanged.
+   */
+  warnings: z.array(z.string()).optional(),
 });
 export type ResultMessage = z.infer<typeof ResultMessageSchema>;
 

package/src/remote-client.ts

@@ -10,8 +10,16 @@
 
 import { spawn } from 'node:child_process';
 import { Readable } from 'node:stream';
-import { type DisplayWriter, ProgressDisplay } from '@celilo/cli-display';
-import * as clack from '@clack/prompts';
+import {
+  type DisplayWriter,
+  ProgressDisplay,
+  isCancel,
+  cancel as uiCancel,
+  confirm as uiConfirm,
+  multiselect as uiMultiselect,
+  select as uiSelect,
+  text as uiText,
+} from '@celilo/cli-display';
 import {
   type ClientMessage,
   type InterviewMessage,
@@ -40,15 +48,17 @@ export class InterviewUnanswerableError extends Error {
 }
 
 /**
- * Render a forwarded interview via clack, returning the operator's answer.
+ * Render a forwarded interview on the terminal, returning the operator's answer.
  *
- * Refuses to prompt when stdin isn't a TTY. clack reads keypresses off stdin
- * whether or not it is a terminal, so on a piped stdin (an MCP server's
- * JSON-RPC stream, a CI harness) the very next newline submits the prompt at
- * its `initialValue` — i.e. the question's `defaultValue` — and the answer
- * looks exactly like a considered human decision. That is how a live rollout
- * came to report "operator declined" for a breaking update nobody was asked
- * about. A client with no terminal must say so instead of guessing.
+ * Refuses to prompt when stdin isn't a TTY, and keeps its own check rather than
+ * relying on the prompt layer's: this is the boundary that must produce an
+ * `unanswerable` message, not an exception. The hazard it guards against is
+ * specific — a prompt that reads keypresses off a non-terminal stdin (an MCP
+ * server's JSON-RPC stream, a CI harness) takes the very next newline as a
+ * submit at the question's `defaultValue`, and the answer is indistinguishable
+ * from a considered human decision. That is how a live rollout came to report
+ * "operator declined" for a breaking update nobody was asked about. A client
+ * with no terminal must say so instead of guessing.
  */
 async function defaultRenderInterview(iv: InterviewMessage): Promise<unknown> {
   if (!process.stdin.isTTY) {
@@ -61,30 +71,30 @@ async function defaultRenderInterview(iv: InterviewMessage): Promise<unknown> {
   let result: unknown;
   switch (iv.kind) {
     case 'confirm':
-      result = await clack.confirm({
+      result = await uiConfirm({
         message: iv.message,
         initialValue: iv.defaultValue === 'true',
       });
       break;
     case 'select':
-      result = await clack.select({ message: iv.message, options });
+      result = await uiSelect({ message: iv.message, options });
       break;
     case 'multiselect':
-      result = await clack.multiselect({
+      result = await uiMultiselect({
         message: iv.message,
         options,
         required: iv.required ?? false,
       });
       break;
     default:
-      result = await clack.text({
+      result = await uiText({
         message: iv.message,
         defaultValue: iv.defaultValue,
         placeholder: iv.placeholder,
       });
   }
-  if (clack.isCancel(result)) {
-    clack.cancel('Cancelled.');
+  if (isCancel(result)) {
+    uiCancel('Cancelled.');
     process.exit(130);
   }
   return result;