@celilo/core 0.6.0 → 0.8.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@celilo/core",
-  "version": "0.6.0",
+  "version": "0.8.0",
   "description": "Lightweight shared core for Celilo CLI tools — command registry, NDJSON API protocol, and remote SSH client. No Ink/React/drizzle/aws-sdk transitive deps, so an MCP server can reach the transport without installing the full CLI.",
   "type": "module",
   "main": "./src/index.ts",
@@ -24,8 +24,7 @@
     "directory": "packages/core"
   },
   "dependencies": {
-    "@celilo/cli-display": "^0.1.10",
-    "@clack/prompts": "^1.1.0",
+    "@celilo/cli-display": "^0.2.0",
     "zod": "^3.24.1"
   }
 }

package/src/command-registry.ts

@@ -581,6 +581,62 @@ export const COMMANDS: CommandDef[] = [
           },
         ],
       },
+      {
+        name: 'pause',
+        description:
+          "Take a module out of celilo's control plane without uninstalling it (keeps running unless --stop-infra)",
+        args: [{ name: 'id', description: 'Module ID', completion: 'module_ids' }],
+        flags: [
+          {
+            name: 'cascade',
+            description: 'Also pause every module that depends on it, consumers first',
+            takesValue: false,
+          },
+          {
+            name: 'stop-infra',
+            description: "Also stop the module's container or service",
+            takesValue: false,
+          },
+          {
+            name: 'reason',
+            description: 'Why the pause was taken, recorded on the module',
+            takesValue: true,
+          },
+          {
+            name: 'dry-run',
+            description: 'Print the ordered plan and change nothing',
+            takesValue: false,
+          },
+          {
+            name: 'yes',
+            description: 'Skip the cascade confirmation',
+            takesValue: false,
+          },
+        ],
+      },
+      {
+        name: 'unpause',
+        description:
+          'Return a paused module to service by redeploying it, rebinding it to the providers present now',
+        args: [{ name: 'id', description: 'Module ID', completion: 'module_ids' }],
+        flags: [
+          {
+            name: 'cascade',
+            description: 'Also unpause everything that depends on it, providers first',
+            takesValue: false,
+          },
+          {
+            name: 'dry-run',
+            description: 'Print the ordered plan and change nothing',
+            takesValue: false,
+          },
+          {
+            name: 'yes',
+            description: 'Skip the cascade confirmation',
+            takesValue: false,
+          },
+        ],
+      },
       {
         name: 'update',
         description:
@@ -659,6 +715,14 @@ export const COMMANDS: CommandDef[] = [
               { name: 'key', description: 'Config key', completion: 'config_keys' },
             ],
           },
+          {
+            name: 'unset',
+            description: "Remove an override so the key follows the module's manifest again",
+            args: [
+              { name: 'id', description: 'Module ID', completion: 'module_ids' },
+              { name: 'key', description: 'Config key', completion: 'config_keys' },
+            ],
+          },
         ],
       },
       {
@@ -1030,6 +1094,29 @@ export const COMMANDS: CommandDef[] = [
       },
     ],
   },
+  {
+    name: 'firewall',
+    description: "Inspect a firewall's interfaces",
+    subcommands: [
+      {
+        name: 'interface',
+        description: 'Interface classification for a firewall',
+        subcommands: [
+          {
+            name: 'list',
+            description:
+              'Show how celilo classifies each interface (zone, external, or unaccounted for)',
+            args: [
+              {
+                name: 'hostname',
+                description: 'Firewall hostname (default: every machine celilo calls a router)',
+              },
+            ],
+          },
+        ],
+      },
+    ],
+  },
   {
     name: 'machine',
     description: 'Manage existing machines (Raspberry Pi, VPS, bare metal)',
@@ -1616,15 +1703,24 @@ export const COMMANDS: CommandDef[] = [
         description: 'Run a monitor now',
         args: [{ name: 'target', description: 'Module id or built-in check name' }],
       },
+      {
+        name: 'set-interval',
+        description:
+          "Change a built-in check's cadence (a module's comes from `module config set <m> health_check_interval`)",
+        args: [
+          { name: 'check', description: 'Built-in check name' },
+          { name: 'cadence', description: 'Cadence, e.g. 15m, 1h, daily' },
+        ],
+      },
       {
         name: 'enable',
-        description: 'Enable a monitor',
-        args: [{ name: 'target', description: 'Module id or built-in check name' }],
+        description: 'Enable a built-in check monitor',
+        args: [{ name: 'target', description: 'Built-in check name' }],
       },
       {
         name: 'disable',
-        description: 'Disable a monitor and resolve its alerts',
-        args: [{ name: 'target', description: 'Module id or built-in check name' }],
+        description: 'Disable a built-in check monitor and resolve its alerts',
+        args: [{ name: 'target', description: 'Built-in check name' }],
       },
     ],
   },

package/src/protocol.ts

@@ -108,6 +108,20 @@ export const ResultMessageSchema = z.object({
   type: z.literal('result'),
   success: z.boolean(),
   exitCode: z.number(),
+  /**
+   * Fleet-level conditions the operator should know about, regardless of what
+   * they ran. Today that is exactly one thing: modules are paused
+   * (openspec/changes/module-pause-lifecycle, design D7).
+   *
+   * Attached to EVERY result, including commands unrelated to the paused
+   * modules, and that is the point — a pause switches off the alerting that
+   * would otherwise report those modules as down, so the only remaining defence
+   * is that the paused-ness is discovered incidentally, while doing something
+   * else. A warning the operator has to go looking for does not do that job.
+   *
+   * Optional so an older client parses a newer server's result unchanged.
+   */
+  warnings: z.array(z.string()).optional(),
 });
 export type ResultMessage = z.infer<typeof ResultMessageSchema>;
 

package/src/remote-client.ts

@@ -10,8 +10,16 @@
 
 import { spawn } from 'node:child_process';
 import { Readable } from 'node:stream';
-import { type DisplayWriter, ProgressDisplay } from '@celilo/cli-display';
-import * as clack from '@clack/prompts';
+import {
+  type DisplayWriter,
+  ProgressDisplay,
+  isCancel,
+  cancel as uiCancel,
+  confirm as uiConfirm,
+  multiselect as uiMultiselect,
+  select as uiSelect,
+  text as uiText,
+} from '@celilo/cli-display';
 import {
   type ClientMessage,
   type InterviewMessage,
@@ -40,15 +48,17 @@ export class InterviewUnanswerableError extends Error {
 }
 
 /**
- * Render a forwarded interview via clack, returning the operator's answer.
+ * Render a forwarded interview on the terminal, returning the operator's answer.
  *
- * Refuses to prompt when stdin isn't a TTY. clack reads keypresses off stdin
- * whether or not it is a terminal, so on a piped stdin (an MCP server's
- * JSON-RPC stream, a CI harness) the very next newline submits the prompt at
- * its `initialValue` — i.e. the question's `defaultValue` — and the answer
- * looks exactly like a considered human decision. That is how a live rollout
- * came to report "operator declined" for a breaking update nobody was asked
- * about. A client with no terminal must say so instead of guessing.
+ * Refuses to prompt when stdin isn't a TTY, and keeps its own check rather than
+ * relying on the prompt layer's: this is the boundary that must produce an
+ * `unanswerable` message, not an exception. The hazard it guards against is
+ * specific — a prompt that reads keypresses off a non-terminal stdin (an MCP
+ * server's JSON-RPC stream, a CI harness) takes the very next newline as a
+ * submit at the question's `defaultValue`, and the answer is indistinguishable
+ * from a considered human decision. That is how a live rollout came to report
+ * "operator declined" for a breaking update nobody was asked about. A client
+ * with no terminal must say so instead of guessing.
  */
 async function defaultRenderInterview(iv: InterviewMessage): Promise<unknown> {
   if (!process.stdin.isTTY) {
@@ -61,30 +71,30 @@ async function defaultRenderInterview(iv: InterviewMessage): Promise<unknown> {
   let result: unknown;
   switch (iv.kind) {
     case 'confirm':
-      result = await clack.confirm({
+      result = await uiConfirm({
         message: iv.message,
         initialValue: iv.defaultValue === 'true',
       });
       break;
     case 'select':
-      result = await clack.select({ message: iv.message, options });
+      result = await uiSelect({ message: iv.message, options });
       break;
     case 'multiselect':
-      result = await clack.multiselect({
+      result = await uiMultiselect({
         message: iv.message,
         options,
         required: iv.required ?? false,
       });
       break;
     default:
-      result = await clack.text({
+      result = await uiText({
         message: iv.message,
         defaultValue: iv.defaultValue,
         placeholder: iv.placeholder,
       });
   }
-  if (clack.isCancel(result)) {
-    clack.cancel('Cancelled.');
+  if (isCancel(result)) {
+    uiCancel('Cancelled.');
     process.exit(130);
   }
   return result;