@celilo/e2e 0.10.4 → 0.11.1

package/registry-server/src/introspection.test.ts

@@ -1,10 +1,6 @@
 import { afterEach, describe, expect, test } from 'bun:test';
 import { ADMIN_SCOPE } from './auth';
-import {
-  IntrospectionVerifier,
-  claimToScope,
-  introspectionConfigFromEnv,
-} from './introspection';
+import { IntrospectionVerifier, claimToScope, introspectionConfigFromEnv } from './introspection';
 
 const CONFIG = {
   endpoint: 'https://idp.test/application/o/introspect/',
@@ -88,9 +84,7 @@ describe('IntrospectionVerifier.scopeOf', () => {
   const verifier = new IntrospectionVerifier(CONFIG);
 
   test('active admin-group token → ADMIN_SCOPE', async () => {
-    stubFetch(() =>
-      introspectResponse({ active: true, sub: 'alice', groups: ['celilo-admins'] }),
-    );
+    stubFetch(() => introspectResponse({ active: true, sub: 'alice', groups: ['celilo-admins'] }));
     expect(await verifier.scopeOf('Bearer idp-token')).toBe(ADMIN_SCOPE);
   });
 
@@ -106,9 +100,7 @@ describe('IntrospectionVerifier.scopeOf', () => {
 
   test('expired exp → null even if active', async () => {
     const pastSec = Math.floor(Date.now() / 1000) - 60;
-    stubFetch(() =>
-      introspectResponse({ active: true, groups: ['celilo-admins'], exp: pastSec }),
-    );
+    stubFetch(() => introspectResponse({ active: true, groups: ['celilo-admins'], exp: pastSec }));
     expect(await verifier.scopeOf('idp-token')).toBeNull();
   });
 
@@ -238,7 +230,11 @@ describe('IntrospectionVerifier.identify (ce-1ch)', () => {
   });
 
   test('admin group is configurable, not a literal', async () => {
-    const custom = new IntrospectionVerifier({ ...CONFIG, adminGroup: 'ops', publisherGroup: 'devs' });
+    const custom = new IntrospectionVerifier({
+      ...CONFIG,
+      adminGroup: 'ops',
+      publisherGroup: 'devs',
+    });
     stubFetch(() => introspectResponse({ active: true, sub: 'dan', groups: ['ops'] }));
     const id = await custom.identify('Bearer t');
     expect(id?.isAdmin).toBe(true);

package/registry-server/src/server.test.ts

@@ -714,7 +714,7 @@ describe('module-owner authorization (ce-1ch)', () => {
     const res = await fetch(`${url}/api/v1/modules/owners/caddy`, {
       headers: { Authorization: 'Bearer opaque-admin' },
     });
-    expect((await res.json() as { owner: { ownerSub: string } }).owner.ownerSub).toBe('ops');
+    expect(((await res.json()) as { owner: { ownerSub: string } }).owner.ownerSub).toBe('ops');
   });
 
   test('admin reassign lets a new owner publish the name', async () => {
@@ -741,7 +741,7 @@ describe('module-owner authorization (ce-1ch)', () => {
       headers: { Authorization: 'Bearer opaque-admin' },
     });
     expect(ok.status).toBe(200);
-    expect((await ok.json() as { owners: unknown[] }).owners).toEqual([]);
+    expect(((await ok.json()) as { owners: unknown[] }).owners).toEqual([]);
   });
 
   test('owner reassign requires admin (a plain publisher cannot)', async () => {

package/registry-server/src/server.ts

@@ -21,7 +21,6 @@
 
 import { join } from 'node:path';
 import { ADMIN_SCOPE, TokenAuth } from './auth';
-import { IntrospectionVerifier } from './introspection';
 import {
   type BootstrapEntry,
   bootstrapIndexEntry,
@@ -29,6 +28,7 @@ import {
   scanBootstrapDir,
   scanUploadsDir,
 } from './bootstrap';
+import { IntrospectionVerifier } from './introspection';
 import { landingResponse } from './landing';
 import { ModuleOwnerStore, fileModuleOwnerPersistence } from './module-owner-store';
 import { type RateLimiter, clientIp, createRateLimiter } from './rate-limit';

package/registry-server/src/storage.test.ts

@@ -37,9 +37,7 @@ describe('RegistryStorage.indexPath', () => {
   });
 
   test('long name uses first 4 chars for directories', () => {
-    expect(storage.indexPath('homebridge')).toBe(
-      join(dataDir, 'index', 'ho', 'me', 'homebridge'),
-    );
+    expect(storage.indexPath('homebridge')).toBe(join(dataDir, 'index', 'ho', 'me', 'homebridge'));
   });
 
   test('real module names produce expected paths', () => {
@@ -128,7 +126,13 @@ describe('RegistryStorage listModules / getModule', () => {
 
   test('listModules returns stored modules with their index entries', () => {
     storage.storePackage('homebridge', '1.0.0+1', Buffer.from('a'));
-    storage.appendIndex({ name: 'homebridge', vers: '1.0.0+1', deps: [], cksum: 'x', yanked: false });
+    storage.appendIndex({
+      name: 'homebridge',
+      vers: '1.0.0+1',
+      deps: [],
+      cksum: 'x',
+      yanked: false,
+    });
     const list = storage.listModules();
     expect(list).toHaveLength(1);
     expect(list[0].name).toBe('homebridge');

package/registry-server/src/storage.ts

@@ -7,8 +7,8 @@
  *   downloads/{name}                                    — per-module download counter (single integer)
  */
 
-import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { createHash } from 'node:crypto';
+import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 
 export interface IndexEntry {

package/registry-server/src/validation.ts

@@ -44,16 +44,14 @@ export function validateNameAndVersion(
     return {
       ok: false,
       field: 'name',
-      message:
-        'Invalid module name — must be kebab-case lowercase, 1-128 chars (e.g. "my-module")',
+      message: 'Invalid module name — must be kebab-case lowercase, 1-128 chars (e.g. "my-module")',
     };
   }
   if (!isValidVersion(vers)) {
     return {
       ok: false,
       field: 'vers',
-      message:
-        'Invalid version — must match "<major>.<minor>.<patch>+<pkgrev>" (e.g. "1.4.2+1")',
+      message: 'Invalid version — must match "<major>.<minor>.<patch>+<pkgrev>" (e.g. "1.4.2+1")',
     };
   }
   return { ok: true };

package/scripts/pack-celilo-packages.ts

@@ -127,10 +127,7 @@ export function rewriteWorkspacePins(
       const version = versions.get(name);
       if (!version) {
         throw new Error(
-          `Cannot rewrite ${bucket} "${name}": "${spec}" — ${name} is not a known ` +
-            `@celilo/* workspace package. Add it to the workspace, or fix the dep name. ` +
-            `(This is the loud failure the old hardcoded pack list lacked — ` +
-            `see apps/celilo/designs/WORKSPACE_PACKAGE_GRAPH.md.)`,
+          `Cannot rewrite ${bucket} "${name}": "${spec}" — ${name} is not a known @celilo/* workspace package. Add it to the workspace, or fix the dep name. (This is the loud failure the old hardcoded pack list lacked — see apps/celilo/designs/WORKSPACE_PACKAGE_GRAPH.md.)`,
         );
       }
       const range = spec.slice('workspace:'.length);

package/scripts/stage-apt-repo.ts

@@ -24,7 +24,7 @@
  */
 
 import { spawnSync } from 'node:child_process';
-import { cpSync, existsSync, mkdirSync, readdirSync, readFileSync, rmSync } from 'node:fs';
+import { cpSync, existsSync, mkdirSync, readFileSync, readdirSync, rmSync } from 'node:fs';
 import { join } from 'node:path';
 
 const green = '\x1b[32m';

package/scripts/stage-libsignal.ts

@@ -102,9 +102,7 @@ export function stageLibsignal(repoRoot: string, pkgDir: string): boolean {
       console.log(`${yellow}skip${reset}  ${dim}(build failed)${reset}`);
       return false;
     }
-    console.log(
-      `${green}✔${reset}  ${dim}${Math.round((Date.now() - t0) / 1000)}s${reset}`,
-    );
+    console.log(`${green}✔${reset}  ${dim}${Math.round((Date.now() - t0) / 1000)}s${reset}`);
   }
 
   process.stdout.write(`  ${'libsignal-jni (stage)'.padEnd(28)} `);

package/simulators/greenwave/server.ts

@@ -68,7 +68,7 @@ const tlsOptions = (() => {
 
 // Bind to internal interface only (like a real router's management UI)
 // The external interface should only handle port-forwarded traffic via iptables
-const BIND_HOST = process.env.ROUTER_BIND_HOST || '192.168.0.1';
+const BIND_HOST = process.env.ROUTER_BIND_HOST || '10.226.1.1';
 
 const server = Bun.serve({
   port: PORT,
@@ -161,4 +161,6 @@ const server = Bun.serve({
   },
 });
 
-console.log(`[greenwave] C4000XG simulator listening on ${BIND_HOST}:${server.port} (${tlsOptions ? 'HTTPS' : 'HTTP'})`);
+console.log(
+  `[greenwave] C4000XG simulator listening on ${BIND_HOST}:${server.port} (${tlsOptions ? 'HTTPS' : 'HTTP'})`,
+);

package/simulators/greenwave/state.ts

@@ -17,11 +17,11 @@ let nextIndex = 1;
 const dhcpPool: Record<string, string> = {
   Alias: 'cpe-Pool-1',
   Enable: 'true',
-  MinAddress: '192.168.0.2',
-  MaxAddress: '192.168.0.150',
+  MinAddress: '10.226.1.2',
+  MaxAddress: '10.226.1.150',
   SubnetMask: '255.255.255.0',
-  IPRouters: '192.168.0.1',
-  DNSServers: '192.168.0.1',
+  IPRouters: '10.226.1.1',
+  DNSServers: '10.226.1.1',
   DomainName: '',
   LeaseTime: '3600',
   Status: 'Enabled',
@@ -117,11 +117,16 @@ export function setDhcpPool(params: Record<string, string>): CgiObject[] {
     rewriteDnsmasqConfig();
   }
 
-  return [{ ObjName: 'Device.DHCPv4.Server.Pool.1.', Param: [{ ParamName: 'Success', ParamValue: 'Success' }] }];
+  return [
+    {
+      ObjName: 'Device.DHCPv4.Server.Pool.1.',
+      Param: [{ ParamName: 'Success', ParamValue: 'Success' }],
+    },
+  ];
 }
 
 function rewriteDnsmasqConfig(): void {
-  const dnsServers = dhcpPool.DNSServers || '192.168.0.1';
+  const dnsServers = dhcpPool.DNSServers || '10.226.1.1';
   const domainName = dhcpPool.DomainName || '';
 
   const lines = [
@@ -129,8 +134,8 @@ function rewriteDnsmasqConfig(): void {
     'port=0',
     'interface=eth0',
     'bind-interfaces',
-    'dhcp-range=192.168.0.200,192.168.0.220,255.255.255.0,60s',
-    'dhcp-option=option:router,192.168.0.1',
+    'dhcp-range=10.226.1.200,10.226.1.220,255.255.255.0,60s',
+    'dhcp-option=option:router,10.226.1.1',
     `dhcp-option=option:dns-server,${dnsServers}`,
     'dhcp-lease-max=20',
     'log-dhcp',
@@ -144,10 +149,13 @@ function rewriteDnsmasqConfig(): void {
     writeFileSync('/etc/dnsmasq.d/e2e.conf', `${lines.join('\n')}\n`);
     // dnsmasq requires full restart to re-read config files (SIGHUP only reloads /etc/hosts)
     try {
-      execSync('pkill -9 dnsmasq; sleep 0.5; dnsmasq --conf-dir=/etc/dnsmasq.d --log-facility=/dev/stderr', {
-        timeout: 5000,
-        shell: '/bin/bash',
-      });
+      execSync(
+        'pkill -9 dnsmasq; sleep 0.5; dnsmasq --conf-dir=/etc/dnsmasq.d --log-facility=/dev/stderr',
+        {
+          timeout: 5000,
+          shell: '/bin/bash',
+        },
+      );
     } catch {}
     console.log(`[greenwave] dnsmasq restarted: DNS=${dnsServers}, domain=${domainName}`);
   } catch (err) {
@@ -168,10 +176,9 @@ function applyIptablesRule(mapping: PortMapping): void {
       { timeout: 5000 },
     );
     // Allow forwarded traffic
-    execSync(
-      `iptables -A FORWARD -p ${p} -d ${intIp} --dport ${intPort} -j ACCEPT`,
-      { timeout: 5000 },
-    );
+    execSync(`iptables -A FORWARD -p ${p} -d ${intIp} --dport ${intPort} -j ACCEPT`, {
+      timeout: 5000,
+    });
   }
 
   try {
@@ -180,7 +187,7 @@ function applyIptablesRule(mapping: PortMapping): void {
       addRules('udp');
     }
   } catch (err) {
-    console.error(`[greenwave] Failed to apply iptables rule:`, err);
+    console.error('[greenwave] Failed to apply iptables rule:', err);
   }
 }
 

package/simulators/isitup/server.ts

@@ -41,11 +41,7 @@ async function probe(targetUrl: string): Promise<ProbeResponse> {
     };
   }
 
-  const port = parsed.port
-    ? Number(parsed.port)
-    : parsed.protocol === 'https:'
-      ? 443
-      : 80;
+  const port = parsed.port ? Number(parsed.port) : parsed.protocol === 'https:' ? 443 : 80;
 
   const start = Date.now();
   try {

package/simulators/namecheap-ddns/server.ts

@@ -8,8 +8,8 @@
  * Returns XML matching the real Namecheap response format.
  */
 
-import { updateZone } from './zone-updater';
 import type { DdnsRecord } from './types';
+import { updateZone } from './zone-updater';
 
 /**
  * Minimal structural type for the bits of Bun's server we use — avoids
@@ -56,9 +56,7 @@ function expectedPasswordFor(domain: string): string {
 const records: Map<string, DdnsRecord> = new Map();
 
 function xmlResponse(errCount: number, ip: string, errors: string[]): Response {
-  const errorElements = errors
-    .map((e, i) => `<Err${i + 1}>${e}</Err${i + 1}>`)
-    .join('\n    ');
+  const errorElements = errors.map((e, i) => `<Err${i + 1}>${e}</Err${i + 1}>`).join('\n    ');
 
   const xml = `<?xml version="1.0" encoding="utf-16"?>
 <interface-response>

package/simulators/namecheap-ddns/zone-updater.test.ts

@@ -23,7 +23,9 @@ describe('namecheap-ddns protected records (e2e-confidence #257)', () => {
     // The guard runs before any readFileSync, so this throws the protection
     // error (not an ENOENT) even with no /config present — proving a DDNS apex
     // clobber of the website-sim can never reach the zone file.
-    expect(() => updateZone('celilo.computer', '@', '100.64.0.1')).toThrow(/reserved e2e infrastructure/);
+    expect(() => updateZone('celilo.computer', '@', '100.64.0.1')).toThrow(
+      /reserved e2e infrastructure/,
+    );
     expect(() => updateZone('celilo.computer', 'www', '100.64.0.1')).toThrow(
       /reserved e2e infrastructure/,
     );

package/simulators/namecheap-ddns/zone-updater.ts

@@ -33,21 +33,17 @@ export function isProtectedRecord(domain: string, host: string): boolean {
 export function updateZone(domain: string, host: string, ip: string): void {
   if (isProtectedRecord(domain, host)) {
     throw new Error(
-      `Refusing DDNS update to "${host}.${domain}": it is reserved e2e infrastructure ` +
-        `(the website-sim), not a DDNS-managed host (e2e-confidence #257).`,
+      `Refusing DDNS update to "${host}.${domain}": it is reserved e2e infrastructure (the website-sim), not a DDNS-managed host (e2e-confidence #257).`,
     );
   }
   const zoneFile = `${ZONE_DIR}/${domain}.zone`;
   let content = readFileSync(zoneFile, 'utf-8');
 
   // Increment SOA serial (YYYYMMDDnn format — just increment the number)
-  content = content.replace(
-    /(\d{10})(\s+\d+\s+\d+\s+\d+\s+\d+\s*\))/,
-    (_match, serial, rest) => {
-      const newSerial = String(Number(serial) + 1);
-      return `${newSerial}${rest}`;
-    },
-  );
+  content = content.replace(/(\d{10})(\s+\d+\s+\d+\s+\d+\s+\d+\s*\))/, (_match, serial, rest) => {
+    const newSerial = String(Number(serial) + 1);
+    return `${newSerial}${rest}`;
+  });
 
   // Check if host already has an A record. Match ANY existing value (\S+),
   // not just dotted-decimal: a prior update may have written a malformed
@@ -61,7 +57,7 @@ export function updateZone(domain: string, host: string, ip: string): void {
     content = content.replace(recordRegex, `${host}    IN A    ${ip}`);
   } else {
     // Append new record
-    content = content.trimEnd() + `\n${host}    IN A    ${ip}\n`;
+    content = `${content.trimEnd()}\n${host}    IN A    ${ip}\n`;
   }
 
   writeFileSync(zoneFile, content);

package/simulators/signal-cli/server.ts

@@ -280,7 +280,9 @@ Bun.serve({
 
     // Verified endpoints on the real daemon.
     if (url.pathname === '/api/v1/check') {
-      return req.method === 'GET' ? new Response(null, { status: 200 }) : new Response(null, { status: 405 });
+      return req.method === 'GET'
+        ? new Response(null, { status: 200 })
+        : new Response(null, { status: 405 });
     }
     if (url.pathname === '/api/v1/events') {
       return new Response('', { status: 200, headers: { 'content-type': 'text/event-stream' } });

package/src/address-plan.test.ts

@@ -0,0 +1,95 @@
+/**
+ * The recurrence gate for #539.
+ *
+ * The sim used to number its zones exactly like a real celilo fleet, so a
+ * leaked stack on celilo's own forgejo-builder (which lives at 10.0.10.12 in
+ * the REAL dmz) put a second interface on the builder's own /24 and blackholed
+ * every containerized CI job's route to the forge. These tests make the two
+ * properties that prevent it non-negotiable:
+ *
+ *   1. every simulated private zone lives inside SIM_PRIVATE_SUPERNET, and
+ *   2. the retired fleet-colliding prefixes appear NOWHERE in the suite.
+ *
+ * (2) is the one that matters in practice: the plan itself is one table, but
+ * shell scripts, Knot zones and dnsmasq configs can't import TypeScript and so
+ * hard-code the values. This is what catches "I changed it in one place".
+ */
+
+import { describe, expect, test } from 'bun:test';
+import { execSync } from 'node:child_process';
+import { SIM_PRIVATE_SUPERNET, ZONE_GATEWAYS, ZONE_SUBNETS, type Zone } from './types';
+import { inCidr } from './zone-classifier';
+
+const REPO_ROOT = execSync('git rev-parse --show-toplevel', {
+  cwd: import.meta.dir,
+  encoding: 'utf-8',
+}).trim();
+
+/**
+ * Prefixes the sim must never use again: the fleet's zone /24s and the
+ * operator's LAN. Prefix match — `10.0.10.` catches an address, a CIDR and a
+ * prose mention alike, which is what we want.
+ */
+const RETIRED_PREFIXES = ['10.0.10.', '10.0.20.', '10.0.30.', '10.0.120.', '192.168.'];
+
+/**
+ * Match the plain form AND the regex-escaped form (`192\.168\.0\.10`). Two
+ * escaped literals inside `toThrow(/…/)` survived the #539 sweep precisely
+ * because a naive search for the plain text does not see them.
+ */
+function toPattern(prefix: string): string {
+  return prefix.replace(/\./g, '\\\\?\\.');
+}
+
+/** Everything that can put an address on a simulated network or assert one. */
+const SCANNED_PATHS = ['packages/e2e', 'e2e/tests', 'modules/*/e2e'];
+
+/**
+ * CHANGELOG is history — it describes what the addresses WERE. This test file
+ * necessarily names the retired prefixes to ban them.
+ */
+const EXCLUDED = [/^packages\/e2e\/CHANGELOG\.md$/, /address-plan\.test\.ts$/];
+
+function grepRetired(): string[] {
+  const pattern = RETIRED_PREFIXES.map(toPattern).join('|');
+  let out = '';
+  try {
+    out = execSync(`git grep -nE '${pattern}' -- ${SCANNED_PATHS.join(' ')}`, {
+      cwd: REPO_ROOT,
+      encoding: 'utf-8',
+      maxBuffer: 8 * 1024 * 1024,
+    });
+  } catch {
+    // git grep exits 1 when there are no matches — that is the passing case.
+    return [];
+  }
+  return out
+    .split('\n')
+    .filter(Boolean)
+    .filter((line) => !EXCLUDED.some((re) => re.test(line.split(':')[0])));
+}
+
+describe('simulated address plan (#539)', () => {
+  test('every zone lives inside the sim supernet', () => {
+    for (const zone of Object.keys(ZONE_SUBNETS) as Zone[]) {
+      const base = ZONE_SUBNETS[zone].split('/')[0];
+      expect(inCidr(base, SIM_PRIVATE_SUPERNET)).toBe(true);
+      expect(inCidr(ZONE_GATEWAYS[zone], SIM_PRIVATE_SUPERNET)).toBe(true);
+      expect(inCidr(ZONE_GATEWAYS[zone], ZONE_SUBNETS[zone])).toBe(true);
+    }
+  });
+
+  test('zones do not overlap each other', () => {
+    const subnets = Object.values(ZONE_SUBNETS);
+    expect(new Set(subnets).size).toBe(subnets.length);
+  });
+
+  test('the fleet-colliding prefixes appear nowhere in the suite', () => {
+    const hits = grepRetired();
+    expect(
+      hits,
+      `The e2e suite must not use a real fleet's addresses (#539). Offending lines:\n${hits.join('\n')}\n\n` +
+        `Use zoneIp()/ZONE_SUBNETS from packages/e2e/src/types.ts, or an address inside ${SIM_PRIVATE_SUPERNET}.`,
+    ).toEqual([]);
+  });
+});

package/src/browser.ts

@@ -14,10 +14,10 @@ export async function startBrowser(
 ): Promise<BrowserHandle> {
   if (!options.chromium) {
     throw new Error(
-      "net.browser() requires a `chromium` launcher in options.\n\n" +
-        "Pass it from your own playwright install:\n" +
+      'net.browser() requires a `chromium` launcher in options.\n\n' +
+        'Pass it from your own playwright install:\n' +
         "  import { chromium } from 'playwright-core';\n" +
-        "  const browser = await net.browser({ vantage, chromium });",
+        '  const browser = await net.browser({ vantage, chromium });',
     );
   }
   const proxy = await startSocksProxy(projectName, options);

package/src/bus-events.ts

@@ -18,11 +18,11 @@
  * without the bus, just without observability hooks.
  */
 
-import { defineEvents, openBus, type Bus } from '@celilo/event-bus';
+import { existsSync, mkdirSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
-import { existsSync, mkdirSync } from 'node:fs';
 import { dirname } from 'node:path';
+import { type Bus, defineEvents, openBus } from '@celilo/event-bus';
 import { z } from 'zod';
 
 const NO_SCHEMAS = defineEvents({});

package/src/cli/command-tree-parser.ts

@@ -21,8 +21,14 @@ function parseCommandsFromHelp(text: string): string[] {
   let inCommandsSection = false;
 
   for (const line of text.split('\n')) {
-    if (/^\s*Commands?:\s*$/i.test(line)) { inCommandsSection = true; continue; }
-    if (inCommandsSection && /^\s*(Options|Examples|Usage):/i.test(line)) { inCommandsSection = false; continue; }
+    if (/^\s*Commands?:\s*$/i.test(line)) {
+      inCommandsSection = true;
+      continue;
+    }
+    if (inCommandsSection && /^\s*(Options|Examples|Usage):/i.test(line)) {
+      inCommandsSection = false;
+      continue;
+    }
     if (!inCommandsSection) continue;
 
     // Match "  command-name" at 2-3 spaces indent, followed by space/bracket/end

package/src/cli/completion.ts

@@ -3,13 +3,7 @@
  * All completions are static (no DB lookups needed).
  */
 
-import {
-  BUILD_INFRA_FLAGS,
-  COMMANDS,
-  DOWN_FLAGS,
-  RUN_FLAGS,
-  UP_PRESETS,
-} from './command-registry';
+import { BUILD_INFRA_FLAGS, COMMANDS, DOWN_FLAGS, RUN_FLAGS, UP_PRESETS } from './command-registry';
 import { findAllTestNames } from './module-discovery';
 
 export function getCompletions(words: string[], current: number): string[] {
@@ -58,7 +52,10 @@ export function getCompletions(words: string[], current: number): string[] {
 
   if (command === 'list' && currentIndex >= 1) {
     const used = new Set(args.slice(1));
-    return filterSuggestions(['--paths'].filter((f) => !used.has(f)), args[currentIndex] || '');
+    return filterSuggestions(
+      ['--paths'].filter((f) => !used.has(f)),
+      args[currentIndex] || '',
+    );
   }
 
   if (command === 'completion' && currentIndex === 1) {

package/src/cli/index.ts

@@ -333,6 +333,7 @@ switch (command) {
     }
     console.log(`\n${tests.length} tests. Run all: cele2e run --all`);
     process.exit(0);
+    break;
   }
 
   case 'up': {
@@ -350,15 +351,18 @@ switch (command) {
       throw err;
     }
     runScript('e2e-up', args);
+    break;
   }
 
   case 'down':
     // Tearing the network down frees the (possibly kept) lock.
     clearLock();
     runScript('e2e-down', args, { E2E_TEST_DIR: stateDir });
+    break;
 
   case 'shell':
     runScript('e2e-shell', args);
+    break;
 
   case 'release': {
     // Free a lock left by `--keep`/`up` (a `kept` stack) so the next run can
@@ -366,6 +370,7 @@ switch (command) {
     const had = clearLock();
     console.log(had ? 'Released the e2e run-lock.' : 'No e2e run-lock held.');
     process.exit(0);
+    break;
   }
 
   case 'status': {
@@ -394,18 +399,20 @@ switch (command) {
         console.log(`  Project:  ${data.projectName}`);
         console.log(`  Test:     ${data.testFile}`);
         console.log(`  Created:  ${data.createdAt}`);
-        console.log(`  Reuse:    cele2e run --reuse`);
-        console.log(`  Tear down: cele2e down`);
+        console.log('  Reuse:    cele2e run --reuse');
+        console.log('  Tear down: cele2e down');
         console.log('');
       } catch {
         /* ignore parse errors */
       }
     }
     runScript('e2e-status', args, projectName ? { CELILO_E2E_PROJECT: projectName } : undefined);
+    break;
   }
 
   case 'load':
     runScript('e2e-load', args);
+    break;
 
   case 'build-infra': {
     const save = args.includes('--save');

package/src/cli/module-discovery.ts

@@ -18,7 +18,9 @@ const MAX_DEPTH = 2;
 
 function readManifestTestsDir(manifestPath: string): string | undefined {
   try {
-    const parsed = parseYaml(readFileSync(manifestPath, 'utf-8')) as { e2e?: { tests_dir?: string } };
+    const parsed = parseYaml(readFileSync(manifestPath, 'utf-8')) as {
+      e2e?: { tests_dir?: string };
+    };
     return parsed?.e2e?.tests_dir;
   } catch {
     return undefined;

package/src/cli/scaffold.ts

@@ -60,8 +60,8 @@ describe('${name}', () => {
     }
 
     net = await network({ projectName: PROJECT_NAME })
-      .dmz({ 'machine-1': '10.0.10.10' })
-      // .app({ 'app-1': '10.0.20.10' })
+      .dmz({ 'machine-1': '10.226.10.10' })
+      // .app({ 'app-1': '10.226.20.10' })
       .start();
   }, 120_000);
 

package/src/cli-version-contract.ts

@@ -17,7 +17,10 @@ export const MIN_CLI_VERSION = '0.9.0';
  * it doesn't, or `null` when OK. No I/O, so it's unit-testable without a
  * running management container.
  */
-export function checkCliVersion(versionStdout: string, minVersion = MIN_CLI_VERSION): string | null {
+export function checkCliVersion(
+  versionStdout: string,
+  minVersion = MIN_CLI_VERSION,
+): string | null {
   // Output is `celilo <version>` (apps/celilo displayVersion). Grab the token.
   const version = versionStdout.match(/celilo\s+(\S+)/)?.[1];
   if (!version) {
@@ -27,11 +30,7 @@ export function checkCliVersion(versionStdout: string, minVersion = MIN_CLI_VERS
     );
   }
   if (Bun.semver.order(version, minVersion) < 0) {
-    return (
-      `Management image has celilo ${version}, harness requires >=${minVersion}. ` +
-      `Rebuild the management image against a newer @celilo/cli ` +
-      `(e.g. \`cele2e build-infra\`, or \`--published\` after publishing).`
-    );
+    return `Management image has celilo ${version}, harness requires >=${minVersion}. Rebuild the management image against a newer @celilo/cli (e.g. \`cele2e build-infra\`, or \`--published\` after publishing).`;
   }
   return null;
 }