@celilo/e2e 0.11.0 → 0.11.2

package/npm-registry-server/src/packument.test.ts

@@ -1,8 +1,8 @@
+import { afterEach, beforeEach, describe, expect, test } from 'bun:test';
 import { execSync } from 'node:child_process';
 import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import { afterEach, beforeEach, describe, expect, test } from 'bun:test';
 
 import {
   buildPackument,
@@ -28,10 +28,7 @@ function packFixture(name: string, version: string): string {
   const slug = `${name.replace(/[@/]/g, '_')}-${version}`;
   const pkgDir = join(tmp, 'pkg', slug);
   mkdirSync(pkgDir, { recursive: true });
-  writeFileSync(
-    join(pkgDir, 'package.json'),
-    JSON.stringify({ name, version, main: 'index.js' }),
-  );
+  writeFileSync(join(pkgDir, 'package.json'), JSON.stringify({ name, version, main: 'index.js' }));
   writeFileSync(join(pkgDir, 'index.js'), `module.exports = '${name}@${version}';\n`);
 
   const stagingDir = join(tmp, 'staging', slug);

package/npm-registry-server/src/packument.ts

@@ -52,7 +52,7 @@ function* iterTarEntries(tar: Buffer): Generator<{ name: string; data: Buffer }>
 
     const rawName = header.subarray(0, 100).toString('utf-8').replace(/\0.*$/, '');
     const sizeStr = header.subarray(124, 136).toString('utf-8').replace(/\0.*$/, '').trim();
-    const size = parseInt(sizeStr, 8) || 0;
+    const size = Number.parseInt(sizeStr, 8) || 0;
     const dataStart = offset + 512;
     const dataEnd = dataStart + size;
 
@@ -109,8 +109,8 @@ export function loadTarballsFromDir(dir: string): TarballMeta[] {
  */
 export function highestVersion(versions: string[]): string {
   return [...versions].sort((a, b) => {
-    const pa = a.split('.').map((s) => parseInt(s, 10) || 0);
-    const pb = b.split('.').map((s) => parseInt(s, 10) || 0);
+    const pa = a.split('.').map((s) => Number.parseInt(s, 10) || 0);
+    const pb = b.split('.').map((s) => Number.parseInt(s, 10) || 0);
     for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
       const da = pa[i] ?? 0;
       const db = pb[i] ?? 0;

package/npm-registry-server/src/server.ts

@@ -16,7 +16,7 @@
  * different staging directory in tests.
  */
 
-import { indexTarballs, loadTarballsFromDir, type TarballMeta } from './packument';
+import { type TarballMeta, indexTarballs, loadTarballsFromDir } from './packument';
 import { buildPackument } from './packument';
 
 interface ServerOptions {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@celilo/e2e",
-  "version": "0.11.0",
+  "version": "0.11.2",
   "description": "E2E test infrastructure for Celilo-deployed applications. Provides a simulated internet with DNS hierarchy, ACME server, firewalls, and target machines in Docker.",
   "type": "module",
   "main": "./src/index.ts",
@@ -37,8 +37,8 @@
     "README.md"
   ],
   "dependencies": {
-    "@celilo/cli-display": "^0.1.9",
-    "@celilo/event-bus": "^0.1.10",
+    "@celilo/cli-display": "^0.1.10",
+    "@celilo/event-bus": "^0.2.0",
     "yaml": "^2.8.0",
     "zod": "^3.24.1"
   },

package/registry-server/src/bootstrap.ts

@@ -15,9 +15,9 @@
  * inert — storage.ts is the only code that touches disk.
  */
 
+import { createHash } from 'node:crypto';
 import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from 'node:fs';
 import { basename, dirname, join, relative } from 'node:path';
-import { createHash } from 'node:crypto';
 import type { IndexEntry } from './storage';
 
 export interface BootstrapEntry {

package/registry-server/src/introspection.test.ts

@@ -1,10 +1,6 @@
 import { afterEach, describe, expect, test } from 'bun:test';
 import { ADMIN_SCOPE } from './auth';
-import {
-  IntrospectionVerifier,
-  claimToScope,
-  introspectionConfigFromEnv,
-} from './introspection';
+import { IntrospectionVerifier, claimToScope, introspectionConfigFromEnv } from './introspection';
 
 const CONFIG = {
   endpoint: 'https://idp.test/application/o/introspect/',
@@ -88,9 +84,7 @@ describe('IntrospectionVerifier.scopeOf', () => {
   const verifier = new IntrospectionVerifier(CONFIG);
 
   test('active admin-group token → ADMIN_SCOPE', async () => {
-    stubFetch(() =>
-      introspectResponse({ active: true, sub: 'alice', groups: ['celilo-admins'] }),
-    );
+    stubFetch(() => introspectResponse({ active: true, sub: 'alice', groups: ['celilo-admins'] }));
     expect(await verifier.scopeOf('Bearer idp-token')).toBe(ADMIN_SCOPE);
   });
 
@@ -106,9 +100,7 @@ describe('IntrospectionVerifier.scopeOf', () => {
 
   test('expired exp → null even if active', async () => {
     const pastSec = Math.floor(Date.now() / 1000) - 60;
-    stubFetch(() =>
-      introspectResponse({ active: true, groups: ['celilo-admins'], exp: pastSec }),
-    );
+    stubFetch(() => introspectResponse({ active: true, groups: ['celilo-admins'], exp: pastSec }));
     expect(await verifier.scopeOf('idp-token')).toBeNull();
   });
 
@@ -238,7 +230,11 @@ describe('IntrospectionVerifier.identify (ce-1ch)', () => {
   });
 
   test('admin group is configurable, not a literal', async () => {
-    const custom = new IntrospectionVerifier({ ...CONFIG, adminGroup: 'ops', publisherGroup: 'devs' });
+    const custom = new IntrospectionVerifier({
+      ...CONFIG,
+      adminGroup: 'ops',
+      publisherGroup: 'devs',
+    });
     stubFetch(() => introspectResponse({ active: true, sub: 'dan', groups: ['ops'] }));
     const id = await custom.identify('Bearer t');
     expect(id?.isAdmin).toBe(true);

package/registry-server/src/server.test.ts

@@ -714,7 +714,7 @@ describe('module-owner authorization (ce-1ch)', () => {
     const res = await fetch(`${url}/api/v1/modules/owners/caddy`, {
       headers: { Authorization: 'Bearer opaque-admin' },
     });
-    expect((await res.json() as { owner: { ownerSub: string } }).owner.ownerSub).toBe('ops');
+    expect(((await res.json()) as { owner: { ownerSub: string } }).owner.ownerSub).toBe('ops');
   });
 
   test('admin reassign lets a new owner publish the name', async () => {
@@ -741,7 +741,7 @@ describe('module-owner authorization (ce-1ch)', () => {
       headers: { Authorization: 'Bearer opaque-admin' },
     });
     expect(ok.status).toBe(200);
-    expect((await ok.json() as { owners: unknown[] }).owners).toEqual([]);
+    expect(((await ok.json()) as { owners: unknown[] }).owners).toEqual([]);
   });
 
   test('owner reassign requires admin (a plain publisher cannot)', async () => {

package/registry-server/src/server.ts

@@ -21,7 +21,6 @@
 
 import { join } from 'node:path';
 import { ADMIN_SCOPE, TokenAuth } from './auth';
-import { IntrospectionVerifier } from './introspection';
 import {
   type BootstrapEntry,
   bootstrapIndexEntry,
@@ -29,6 +28,7 @@ import {
   scanBootstrapDir,
   scanUploadsDir,
 } from './bootstrap';
+import { IntrospectionVerifier } from './introspection';
 import { landingResponse } from './landing';
 import { ModuleOwnerStore, fileModuleOwnerPersistence } from './module-owner-store';
 import { type RateLimiter, clientIp, createRateLimiter } from './rate-limit';

package/registry-server/src/storage.test.ts

@@ -37,9 +37,7 @@ describe('RegistryStorage.indexPath', () => {
   });
 
   test('long name uses first 4 chars for directories', () => {
-    expect(storage.indexPath('homebridge')).toBe(
-      join(dataDir, 'index', 'ho', 'me', 'homebridge'),
-    );
+    expect(storage.indexPath('homebridge')).toBe(join(dataDir, 'index', 'ho', 'me', 'homebridge'));
   });
 
   test('real module names produce expected paths', () => {
@@ -128,7 +126,13 @@ describe('RegistryStorage listModules / getModule', () => {
 
   test('listModules returns stored modules with their index entries', () => {
     storage.storePackage('homebridge', '1.0.0+1', Buffer.from('a'));
-    storage.appendIndex({ name: 'homebridge', vers: '1.0.0+1', deps: [], cksum: 'x', yanked: false });
+    storage.appendIndex({
+      name: 'homebridge',
+      vers: '1.0.0+1',
+      deps: [],
+      cksum: 'x',
+      yanked: false,
+    });
     const list = storage.listModules();
     expect(list).toHaveLength(1);
     expect(list[0].name).toBe('homebridge');

package/registry-server/src/storage.ts

@@ -7,8 +7,8 @@
  *   downloads/{name}                                    — per-module download counter (single integer)
  */
 
-import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { createHash } from 'node:crypto';
+import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 
 export interface IndexEntry {

package/registry-server/src/validation.ts

@@ -44,16 +44,14 @@ export function validateNameAndVersion(
     return {
       ok: false,
       field: 'name',
-      message:
-        'Invalid module name — must be kebab-case lowercase, 1-128 chars (e.g. "my-module")',
+      message: 'Invalid module name — must be kebab-case lowercase, 1-128 chars (e.g. "my-module")',
     };
   }
   if (!isValidVersion(vers)) {
     return {
       ok: false,
       field: 'vers',
-      message:
-        'Invalid version — must match "<major>.<minor>.<patch>+<pkgrev>" (e.g. "1.4.2+1")',
+      message: 'Invalid version — must match "<major>.<minor>.<patch>+<pkgrev>" (e.g. "1.4.2+1")',
     };
   }
   return { ok: true };

package/scripts/consumer-paths-changed.ts

@@ -0,0 +1,83 @@
+#!/usr/bin/env bun
+/**
+ * Does this push touch the npm-consumer-smoke consumer path?
+ *
+ * This list used to live in `npm-consumer-smoke.yml`'s `on.push.paths`, where
+ * it decided whether the WORKFLOW TRIGGERED at all. That made a required status
+ * check that often posted no status: a push touching none of these paths
+ * created no run, so the `npm-consumer-smoke*` context branch protection
+ * requires never reported, and the PR was blocked on a check that was never
+ * going to run (celilo#603).
+ *
+ * The workflow now always triggers and always reports; this decides whether it
+ * does the expensive Docker work. Same paths, same intent — the filter moved
+ * from "should CI speak" to "should CI do the work".
+ *
+ * DEFAULT TO RUNNING. Every uncertainty here resolves to `true`. Skipping when
+ * we should have run is a silent false green on a release-path gate; running
+ * when we needn't costs a few minutes of builder time.
+ */
+
+/** Kept verbatim from the trigger's former `paths:` list. */
+export const CONSUMER_PATHS = [
+  'packages/e2e/**',
+  'packages/registry-server/**',
+  // The publish driver (moved from the dead apps/celilo/scripts/publish.ts).
+  'apps/celilo/src/cli/commands/publish/**',
+  'scripts/publish.ts',
+  // (The derived release graph lives at packages/e2e/scripts/workspace-graph.ts,
+  // already covered by packages/e2e/** above.)
+  // Every workspace package.json — the actual input to the package graph.
+  // Narrowed to workspace members (not **/package.json) so a devDependency bump
+  // in an unrelated dir doesn't fire this heavy Docker job; the cheap sync gate
+  // in ci.yml catches graph drift on every PR regardless.
+  'apps/*/package.json',
+  'packages/*/package.json',
+  'package.json',
+];
+
+interface PushCommit {
+  added?: string[];
+  modified?: string[];
+  removed?: string[];
+}
+
+export interface PushPayload {
+  commits?: PushCommit[];
+  total_commits?: number;
+}
+
+export function touchesConsumerPath(files: string[]): boolean {
+  return files.some((file) => CONSUMER_PATHS.some((glob) => new Bun.Glob(glob).match(file)));
+}
+
+export function pushIsRelevant(payload: PushPayload): boolean {
+  const commits = payload.commits ?? [];
+
+  // No commit list to reason from — a payload shape we don't understand is not
+  // evidence that nothing changed.
+  if (commits.length === 0) return true;
+
+  // Forgejo caps `commits[]` on a large push while `total_commits` reports the
+  // real number. The unlisted commits are exactly the ones we cannot inspect.
+  if ((payload.total_commits ?? commits.length) > commits.length) return true;
+
+  // A commit carrying none of the three arrays told us nothing about its
+  // files. That is not the same as a commit that changed nothing — no such
+  // commit exists — so it is an unknown, and unknowns run.
+  if (commits.some((c) => !c.added && !c.modified && !c.removed)) return true;
+
+  return touchesConsumerPath(
+    commits.flatMap((c) => [...(c.added ?? []), ...(c.modified ?? []), ...(c.removed ?? [])]),
+  );
+}
+
+if (import.meta.main) {
+  const eventPath = process.env.GITHUB_EVENT_PATH;
+  // A manual dispatch (or any non-push event) means someone asked for it.
+  const relevant =
+    process.env.GITHUB_EVENT_NAME !== 'push' || !eventPath
+      ? true
+      : pushIsRelevant(await Bun.file(eventPath).json());
+  console.log(relevant ? 'true' : 'false');
+}

package/scripts/pack-celilo-packages.ts

@@ -127,10 +127,7 @@ export function rewriteWorkspacePins(
       const version = versions.get(name);
       if (!version) {
         throw new Error(
-          `Cannot rewrite ${bucket} "${name}": "${spec}" — ${name} is not a known ` +
-            `@celilo/* workspace package. Add it to the workspace, or fix the dep name. ` +
-            `(This is the loud failure the old hardcoded pack list lacked — ` +
-            `see apps/celilo/designs/WORKSPACE_PACKAGE_GRAPH.md.)`,
+          `Cannot rewrite ${bucket} "${name}": "${spec}" — ${name} is not a known @celilo/* workspace package. Add it to the workspace, or fix the dep name. (This is the loud failure the old hardcoded pack list lacked — see apps/celilo/designs/WORKSPACE_PACKAGE_GRAPH.md.)`,
         );
       }
       const range = spec.slice('workspace:'.length);

package/scripts/stage-apt-repo.ts

@@ -24,7 +24,7 @@
  */
 
 import { spawnSync } from 'node:child_process';
-import { cpSync, existsSync, mkdirSync, readdirSync, readFileSync, rmSync } from 'node:fs';
+import { cpSync, existsSync, mkdirSync, readFileSync, readdirSync, rmSync } from 'node:fs';
 import { join } from 'node:path';
 
 const green = '\x1b[32m';

package/scripts/stage-libsignal.ts

@@ -102,9 +102,7 @@ export function stageLibsignal(repoRoot: string, pkgDir: string): boolean {
       console.log(`${yellow}skip${reset}  ${dim}(build failed)${reset}`);
       return false;
     }
-    console.log(
-      `${green}✔${reset}  ${dim}${Math.round((Date.now() - t0) / 1000)}s${reset}`,
-    );
+    console.log(`${green}✔${reset}  ${dim}${Math.round((Date.now() - t0) / 1000)}s${reset}`);
   }
 
   process.stdout.write(`  ${'libsignal-jni (stage)'.padEnd(28)} `);

package/simulators/greenwave/server.ts

@@ -161,4 +161,6 @@ const server = Bun.serve({
   },
 });
 
-console.log(`[greenwave] C4000XG simulator listening on ${BIND_HOST}:${server.port} (${tlsOptions ? 'HTTPS' : 'HTTP'})`);
+console.log(
+  `[greenwave] C4000XG simulator listening on ${BIND_HOST}:${server.port} (${tlsOptions ? 'HTTPS' : 'HTTP'})`,
+);

package/simulators/greenwave/state.ts

@@ -117,7 +117,12 @@ export function setDhcpPool(params: Record<string, string>): CgiObject[] {
     rewriteDnsmasqConfig();
   }
 
-  return [{ ObjName: 'Device.DHCPv4.Server.Pool.1.', Param: [{ ParamName: 'Success', ParamValue: 'Success' }] }];
+  return [
+    {
+      ObjName: 'Device.DHCPv4.Server.Pool.1.',
+      Param: [{ ParamName: 'Success', ParamValue: 'Success' }],
+    },
+  ];
 }
 
 function rewriteDnsmasqConfig(): void {
@@ -144,10 +149,13 @@ function rewriteDnsmasqConfig(): void {
     writeFileSync('/etc/dnsmasq.d/e2e.conf', `${lines.join('\n')}\n`);
     // dnsmasq requires full restart to re-read config files (SIGHUP only reloads /etc/hosts)
     try {
-      execSync('pkill -9 dnsmasq; sleep 0.5; dnsmasq --conf-dir=/etc/dnsmasq.d --log-facility=/dev/stderr', {
-        timeout: 5000,
-        shell: '/bin/bash',
-      });
+      execSync(
+        'pkill -9 dnsmasq; sleep 0.5; dnsmasq --conf-dir=/etc/dnsmasq.d --log-facility=/dev/stderr',
+        {
+          timeout: 5000,
+          shell: '/bin/bash',
+        },
+      );
     } catch {}
     console.log(`[greenwave] dnsmasq restarted: DNS=${dnsServers}, domain=${domainName}`);
   } catch (err) {
@@ -168,10 +176,9 @@ function applyIptablesRule(mapping: PortMapping): void {
       { timeout: 5000 },
     );
     // Allow forwarded traffic
-    execSync(
-      `iptables -A FORWARD -p ${p} -d ${intIp} --dport ${intPort} -j ACCEPT`,
-      { timeout: 5000 },
-    );
+    execSync(`iptables -A FORWARD -p ${p} -d ${intIp} --dport ${intPort} -j ACCEPT`, {
+      timeout: 5000,
+    });
   }
 
   try {
@@ -180,7 +187,7 @@ function applyIptablesRule(mapping: PortMapping): void {
       addRules('udp');
     }
   } catch (err) {
-    console.error(`[greenwave] Failed to apply iptables rule:`, err);
+    console.error('[greenwave] Failed to apply iptables rule:', err);
   }
 }
 

package/simulators/isitup/server.ts

@@ -41,11 +41,7 @@ async function probe(targetUrl: string): Promise<ProbeResponse> {
     };
   }
 
-  const port = parsed.port
-    ? Number(parsed.port)
-    : parsed.protocol === 'https:'
-      ? 443
-      : 80;
+  const port = parsed.port ? Number(parsed.port) : parsed.protocol === 'https:' ? 443 : 80;
 
   const start = Date.now();
   try {

package/simulators/namecheap-ddns/server.ts

@@ -8,8 +8,8 @@
  * Returns XML matching the real Namecheap response format.
  */
 
-import { updateZone } from './zone-updater';
 import type { DdnsRecord } from './types';
+import { updateZone } from './zone-updater';
 
 /**
  * Minimal structural type for the bits of Bun's server we use — avoids
@@ -56,9 +56,7 @@ function expectedPasswordFor(domain: string): string {
 const records: Map<string, DdnsRecord> = new Map();
 
 function xmlResponse(errCount: number, ip: string, errors: string[]): Response {
-  const errorElements = errors
-    .map((e, i) => `<Err${i + 1}>${e}</Err${i + 1}>`)
-    .join('\n    ');
+  const errorElements = errors.map((e, i) => `<Err${i + 1}>${e}</Err${i + 1}>`).join('\n    ');
 
   const xml = `<?xml version="1.0" encoding="utf-16"?>
 <interface-response>

package/simulators/namecheap-ddns/zone-updater.test.ts

@@ -23,7 +23,9 @@ describe('namecheap-ddns protected records (e2e-confidence #257)', () => {
     // The guard runs before any readFileSync, so this throws the protection
     // error (not an ENOENT) even with no /config present — proving a DDNS apex
     // clobber of the website-sim can never reach the zone file.
-    expect(() => updateZone('celilo.computer', '@', '100.64.0.1')).toThrow(/reserved e2e infrastructure/);
+    expect(() => updateZone('celilo.computer', '@', '100.64.0.1')).toThrow(
+      /reserved e2e infrastructure/,
+    );
     expect(() => updateZone('celilo.computer', 'www', '100.64.0.1')).toThrow(
       /reserved e2e infrastructure/,
     );

package/simulators/namecheap-ddns/zone-updater.ts

@@ -33,21 +33,17 @@ export function isProtectedRecord(domain: string, host: string): boolean {
 export function updateZone(domain: string, host: string, ip: string): void {
   if (isProtectedRecord(domain, host)) {
     throw new Error(
-      `Refusing DDNS update to "${host}.${domain}": it is reserved e2e infrastructure ` +
-        `(the website-sim), not a DDNS-managed host (e2e-confidence #257).`,
+      `Refusing DDNS update to "${host}.${domain}": it is reserved e2e infrastructure (the website-sim), not a DDNS-managed host (e2e-confidence #257).`,
     );
   }
   const zoneFile = `${ZONE_DIR}/${domain}.zone`;
   let content = readFileSync(zoneFile, 'utf-8');
 
   // Increment SOA serial (YYYYMMDDnn format — just increment the number)
-  content = content.replace(
-    /(\d{10})(\s+\d+\s+\d+\s+\d+\s+\d+\s*\))/,
-    (_match, serial, rest) => {
-      const newSerial = String(Number(serial) + 1);
-      return `${newSerial}${rest}`;
-    },
-  );
+  content = content.replace(/(\d{10})(\s+\d+\s+\d+\s+\d+\s+\d+\s*\))/, (_match, serial, rest) => {
+    const newSerial = String(Number(serial) + 1);
+    return `${newSerial}${rest}`;
+  });
 
   // Check if host already has an A record. Match ANY existing value (\S+),
   // not just dotted-decimal: a prior update may have written a malformed
@@ -61,7 +57,7 @@ export function updateZone(domain: string, host: string, ip: string): void {
     content = content.replace(recordRegex, `${host}    IN A    ${ip}`);
   } else {
     // Append new record
-    content = content.trimEnd() + `\n${host}    IN A    ${ip}\n`;
+    content = `${content.trimEnd()}\n${host}    IN A    ${ip}\n`;
   }
 
   writeFileSync(zoneFile, content);

package/simulators/signal-cli/server.ts

@@ -280,7 +280,9 @@ Bun.serve({
 
     // Verified endpoints on the real daemon.
     if (url.pathname === '/api/v1/check') {
-      return req.method === 'GET' ? new Response(null, { status: 200 }) : new Response(null, { status: 405 });
+      return req.method === 'GET'
+        ? new Response(null, { status: 200 })
+        : new Response(null, { status: 405 });
     }
     if (url.pathname === '/api/v1/events') {
       return new Response('', { status: 200, headers: { 'content-type': 'text/event-stream' } });

package/src/browser.ts

@@ -14,10 +14,10 @@ export async function startBrowser(
 ): Promise<BrowserHandle> {
   if (!options.chromium) {
     throw new Error(
-      "net.browser() requires a `chromium` launcher in options.\n\n" +
-        "Pass it from your own playwright install:\n" +
+      'net.browser() requires a `chromium` launcher in options.\n\n' +
+        'Pass it from your own playwright install:\n' +
         "  import { chromium } from 'playwright-core';\n" +
-        "  const browser = await net.browser({ vantage, chromium });",
+        '  const browser = await net.browser({ vantage, chromium });',
     );
   }
   const proxy = await startSocksProxy(projectName, options);

package/src/bus-events.ts

@@ -18,11 +18,11 @@
  * without the bus, just without observability hooks.
  */
 
-import { defineEvents, openBus, type Bus } from '@celilo/event-bus';
+import { existsSync, mkdirSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
-import { existsSync, mkdirSync } from 'node:fs';
 import { dirname } from 'node:path';
+import { type Bus, defineEvents, openBus } from '@celilo/event-bus';
 import { z } from 'zod';
 
 const NO_SCHEMAS = defineEvents({});

package/src/cli/command-tree-parser.ts

@@ -21,8 +21,14 @@ function parseCommandsFromHelp(text: string): string[] {
   let inCommandsSection = false;
 
   for (const line of text.split('\n')) {
-    if (/^\s*Commands?:\s*$/i.test(line)) { inCommandsSection = true; continue; }
-    if (inCommandsSection && /^\s*(Options|Examples|Usage):/i.test(line)) { inCommandsSection = false; continue; }
+    if (/^\s*Commands?:\s*$/i.test(line)) {
+      inCommandsSection = true;
+      continue;
+    }
+    if (inCommandsSection && /^\s*(Options|Examples|Usage):/i.test(line)) {
+      inCommandsSection = false;
+      continue;
+    }
     if (!inCommandsSection) continue;
 
     // Match "  command-name" at 2-3 spaces indent, followed by space/bracket/end

package/src/cli/completion.ts

@@ -3,13 +3,7 @@
  * All completions are static (no DB lookups needed).
  */
 
-import {
-  BUILD_INFRA_FLAGS,
-  COMMANDS,
-  DOWN_FLAGS,
-  RUN_FLAGS,
-  UP_PRESETS,
-} from './command-registry';
+import { BUILD_INFRA_FLAGS, COMMANDS, DOWN_FLAGS, RUN_FLAGS, UP_PRESETS } from './command-registry';
 import { findAllTestNames } from './module-discovery';
 
 export function getCompletions(words: string[], current: number): string[] {
@@ -58,7 +52,10 @@ export function getCompletions(words: string[], current: number): string[] {
 
   if (command === 'list' && currentIndex >= 1) {
     const used = new Set(args.slice(1));
-    return filterSuggestions(['--paths'].filter((f) => !used.has(f)), args[currentIndex] || '');
+    return filterSuggestions(
+      ['--paths'].filter((f) => !used.has(f)),
+      args[currentIndex] || '',
+    );
   }
 
   if (command === 'completion' && currentIndex === 1) {

package/src/cli/index.ts

@@ -333,6 +333,7 @@ switch (command) {
     }
     console.log(`\n${tests.length} tests. Run all: cele2e run --all`);
     process.exit(0);
+    break;
   }
 
   case 'up': {
@@ -350,15 +351,18 @@ switch (command) {
       throw err;
     }
     runScript('e2e-up', args);
+    break;
   }
 
   case 'down':
     // Tearing the network down frees the (possibly kept) lock.
     clearLock();
     runScript('e2e-down', args, { E2E_TEST_DIR: stateDir });
+    break;
 
   case 'shell':
     runScript('e2e-shell', args);
+    break;
 
   case 'release': {
     // Free a lock left by `--keep`/`up` (a `kept` stack) so the next run can
@@ -366,6 +370,7 @@ switch (command) {
     const had = clearLock();
     console.log(had ? 'Released the e2e run-lock.' : 'No e2e run-lock held.');
     process.exit(0);
+    break;
   }
 
   case 'status': {
@@ -394,18 +399,20 @@ switch (command) {
         console.log(`  Project:  ${data.projectName}`);
         console.log(`  Test:     ${data.testFile}`);
         console.log(`  Created:  ${data.createdAt}`);
-        console.log(`  Reuse:    cele2e run --reuse`);
-        console.log(`  Tear down: cele2e down`);
+        console.log('  Reuse:    cele2e run --reuse');
+        console.log('  Tear down: cele2e down');
         console.log('');
       } catch {
         /* ignore parse errors */
       }
     }
     runScript('e2e-status', args, projectName ? { CELILO_E2E_PROJECT: projectName } : undefined);
+    break;
   }
 
   case 'load':
     runScript('e2e-load', args);
+    break;
 
   case 'build-infra': {
     const save = args.includes('--save');

package/src/cli/module-discovery.ts

@@ -18,7 +18,9 @@ const MAX_DEPTH = 2;
 
 function readManifestTestsDir(manifestPath: string): string | undefined {
   try {
-    const parsed = parseYaml(readFileSync(manifestPath, 'utf-8')) as { e2e?: { tests_dir?: string } };
+    const parsed = parseYaml(readFileSync(manifestPath, 'utf-8')) as {
+      e2e?: { tests_dir?: string };
+    };
     return parsed?.e2e?.tests_dir;
   } catch {
     return undefined;