@celilo/e2e 0.16.0 → 0.17.0

package/config/socks/startup.sh

@@ -34,6 +34,13 @@ esac
 ip route del default 2>/dev/null || true
 ip route add default via "$GATEWAY"
 
+# An explicit resolver from the caller wins over the vantage default. The proxy
+# is what resolves names for a SOCKS5 client — a browser hands it the hostname
+# and never resolves it itself — so a test driving a browser at a name only the
+# fleet's own resolver knows has to say so here. Modelling a real device: one
+# on the internal zone is handed the fleet's resolver, not a fixed stub.
+NAMESERVER="${NAMESERVER_OVERRIDE:-$NAMESERVER}"
+
 # Bypass docker's embedded resolver — point directly at the in-network
 # DNS so split-horizon and the namecheap simulator both behave correctly.
 echo "nameserver $NAMESERVER" > /etc/resolv.conf

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@celilo/e2e",
-  "version": "0.16.0",
+  "version": "0.17.0",
   "description": "E2E test infrastructure for Celilo-deployed applications. Provides a simulated internet with DNS hierarchy, ACME server, firewalls, and target machines in Docker.",
   "type": "module",
   "main": "./src/index.ts",
@@ -37,10 +37,10 @@
     "README.md"
   ],
   "dependencies": {
-    "@celilo/capabilities": "^1.5.0",
+    "@celilo/capabilities": "^2.1.0",
     "@celilo/cli-display": "^0.2.0",
     "@celilo/event-bus": "^0.6.0",
-    "@celilo/terraform-fake": "^0.3.0",
+    "@celilo/terraform-fake": "^0.3.1",
     "yaml": "^2.8.0",
     "zod": "^3.24.1"
   },

package/src/container-manager.ts

@@ -708,11 +708,19 @@ function buildNetworkHandle(
         );
       }
       // Kill any prior responder (idempotent: replaces prior values map).
+      //
+      // Matched on "events respond", NOT "celilo events respond": inside the
+      // e2e management image `celilo` is a dev-mode shim that execs `bun run
+      // .../index.ts events respond ...`, so the literal word "celilo" never
+      // appears contiguous with "events respond" in the resulting process's
+      // argv — the old pattern silently matched nothing, so a second
+      // `respondWith()` call left the FIRST responder (and its stale values
+      // map) running alongside the new one instead of replacing it.
       dockerExec(
         projectName,
         composeDir,
         'management',
-        'pkill -f "celilo events respond" 2>/dev/null || true',
+        'pkill -f "events respond" 2>/dev/null || true',
         5_000,
       );
       // Spawn detached. nohup + & + disown cleanly survives the

package/src/socks-proxy.ts

@@ -22,6 +22,19 @@ export interface SocksProxyOptions {
    *   zones via the firewall.
    */
   vantage?: SocksProxyVantage;
+  /**
+   * Resolver the proxy should use instead of the vantage's baked default.
+   *
+   * The PROXY resolves names for a SOCKS5 client: chromium configured with
+   * `socks5://` sends the hostname and never resolves it itself. A test driving
+   * a browser at a name only the fleet's own resolver knows — anything on a
+   * private ingress — therefore has to point the proxy at that resolver.
+   *
+   * More faithful rather than less: the rig's baked stub answers a fixed
+   * split-horizon table, whereas a device on the internal zone is handed the
+   * fleet's resolver. Pass the deployed resolver's DNS-ingress address.
+   */
+  nameserver?: string;
 }
 
 export interface SocksProxyHandle {
@@ -69,8 +82,22 @@ const VANTAGE_CONFIGS: Record<SocksProxyVantage, VantageConfig> = {
   },
 };
 
-function containerNameFor(projectName: string, vantage: SocksProxyVantage): string {
-  return `${projectName}-socks-${vantage}`;
+/**
+ * Deterministic per (project, vantage, resolver).
+ *
+ * The resolver is part of the identity because a proxy is REUSED by name: two
+ * calls differing only in `nameserver` would otherwise silently share one
+ * container, and the second would resolve through the first's resolver. That
+ * failure looks like a DNS bug in the fleet, which is the worst possible place
+ * for it to look like anything.
+ */
+function containerNameFor(
+  projectName: string,
+  vantage: SocksProxyVantage,
+  nameserver?: string,
+): string {
+  const suffix = nameserver ? `-dns-${nameserver.replace(/\./g, '-')}` : '';
+  return `${projectName}-socks-${vantage}${suffix}`;
 }
 
 /**
@@ -85,7 +112,7 @@ export async function startSocksProxy(
   const vantage = options.vantage ?? 'isp-external';
   const cfg = VANTAGE_CONFIGS[vantage];
   const networkName = `${projectName}_${cfg.network}`;
-  const containerName = containerNameFor(projectName, vantage);
+  const containerName = containerNameFor(projectName, vantage, options.nameserver);
 
   // Reuse existing container if one is running for this project + vantage
   const existing = inspectContainer(containerName);
@@ -113,6 +140,7 @@ export async function startSocksProxy(
         `--ip ${cfg.ip}`,
         '--cap-add NET_ADMIN',
         `-e VANTAGE=${vantage}`,
+        ...(options.nameserver ? [`-e NAMESERVER_OVERRIDE=${options.nameserver}`] : []),
         '-p 127.0.0.1::1080',
         PROXY_IMAGE,
       ].join(' '),

package/src/types.ts

@@ -182,6 +182,20 @@ export class CeliloCommandError extends Error {
  */
 export interface ProxyOptions {
   vantage?: 'isp-external' | 'internal';
+  /**
+   * Resolver the proxy should use, overriding the vantage's baked default.
+   *
+   * The proxy is what actually resolves names: a browser configured with
+   * `socks5://` hands the HOSTNAME to the proxy and never resolves it itself.
+   * So a test driving a browser at a name only the fleet's own resolver knows
+   * — anything on a private ingress — must point the proxy at that resolver.
+   *
+   * This is more faithful, not less: the rig's baked stub answers a fixed
+   * split-horizon table, whereas a real device on the internal zone is handed
+   * the fleet's resolver by DHCP. Pass the deployed resolver's DNS-ingress
+   * address here to model that.
+   */
+  nameserver?: string;
 }
 
 export interface SocksProxyHandle {