@celilo/e2e 0.19.1 → 0.19.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@celilo/e2e",
-  "version": "0.19.1",
+  "version": "0.19.3",
   "description": "E2E test infrastructure for Celilo-deployed applications. Provides a simulated internet with DNS hierarchy, ACME server, firewalls, and target machines in Docker.",
   "type": "module",
   "main": "./src/index.ts",
@@ -37,7 +37,7 @@
     "README.md"
   ],
   "dependencies": {
-    "@celilo/capabilities": "^3.3.0",
+    "@celilo/capabilities": "^4.1.0",
     "@celilo/cli-display": "^0.2.0",
     "@celilo/event-bus": "^0.6.0",
     "@celilo/terraform-fake": "^0.3.1",

package/registry-server/src/server.test.ts

@@ -275,6 +275,44 @@ describe('GET /api/v1/modules (search)', () => {
     expect(body.modules.find((m) => m.name === 'caddy')?.icon).toBe('\u25cd');
   });
 
+  test('409 when a second module declares a glyph the first holds, naming the holder', async () => {
+    // module-icons D8 — the registry refuses a duplicate glyph. The error must
+    // name the holding module: that is everything the author needs to pick a
+    // distinct glyph, and it is what the design decided a refusal carries
+    // instead of a server-suggested replacement.
+    expect((await publish('homebridge', '1.0.0+1', 'valid-token', 'Bridge', '\u22c8')).status).toBe(
+      200,
+    );
+    const res = await publish('caddy', '1.0.0+1', 'valid-token', 'Proxy', '\u22c8');
+    expect(res.status).toBe(409);
+    const body = (await res.json()) as { errors: Array<{ detail: string }> };
+    expect(body.errors[0]?.detail).toContain('homebridge');
+    // The refusal fired before any state was written: no payload, no index line.
+    expect((await fetch(`${baseUrl}/index/ca/dd/caddy`)).status).toBe(404);
+  });
+
+  test('a module republishing its own glyph across versions is allowed', async () => {
+    // The holder is excluded from its own check — keeping your icon across
+    // versions is the normal case, not a collision.
+    expect((await publish('homebridge', '1.0.0+1', 'valid-token', 'Bridge', '\u22c8')).status).toBe(
+      200,
+    );
+    expect((await publish('homebridge', '1.0.1+1', 'valid-token', 'Bridge', '\u22c8')).status).toBe(
+      200,
+    );
+  });
+
+  test('a module whose latest version drops the icon frees the glyph', async () => {
+    // A module holds the glyph its LATEST non-yanked entry declares — the same
+    // selection the browse endpoints read. Once its newest version declares
+    // none, the glyph is free for the next publisher.
+    expect((await publish('homebridge', '1.0.0+1', 'valid-token', 'Bridge', '\u22c8')).status).toBe(
+      200,
+    );
+    expect((await publish('homebridge', '1.0.1+1', 'valid-token', 'Bridge')).status).toBe(200);
+    expect((await publish('caddy', '1.0.0+1', 'valid-token', 'Proxy', '\u22c8')).status).toBe(200);
+  });
+
   test('total_downloads reflects actual download count, sort=downloads orders by it', async () => {
     // Publish two modules, hit one's download endpoint several times.
     // The search response should show those counts and sort=downloads

package/registry-server/src/server.ts

@@ -339,6 +339,23 @@ export function startServer(options: ServerOptions): ReturnType<typeof Bun.serve
       return err(`Version ${name}@${vers} already exists — versions are immutable`, 409);
     }
 
+    // The registry refuses a glyph another module already holds (module-icons
+    // D8, operator ruling 2026-09-01). The module's own earlier versions are
+    // excluded: republishing with the icon you already have is the normal
+    // case, not a collision. Before any mutation — a refusal must not leave a
+    // stored payload behind, the same ordering discipline as the check above.
+    if (icon) {
+      const holder = [...storage.latestIcons()].find(
+        ([heldName, heldIcon]) => heldName !== name && heldIcon === icon,
+      );
+      if (holder) {
+        return err(
+          `icon '${icon}' is already used by module ${holder[0]} — declare a glyph no other module holds (openspec/changes/module-icons, D8)`,
+          409,
+        );
+      }
+    }
+
     const cksum = storage.storePackage(name, vers, fileData);
     storage.appendIndex({
       name,

package/registry-server/src/storage.ts

@@ -189,6 +189,25 @@ export class RegistryStorage {
     return versions.length > 0 ? { name, versions } : null;
   }
 
+  /**
+   * The glyph each module holds, keyed by module name. A module holds the
+   * icon on its latest non-yanked entry — the same "latest" the browse
+   * endpoints read, so a module holds exactly the glyph a consumer would
+   * render for it. Modules whose latest entry declares no icon are absent.
+   *
+   * This is the set the publish-time duplicate-icon refusal compares against
+   * (openspec/changes/module-icons, D8): a new publish declaring a glyph in
+   * this map, under a different name, is rejected.
+   */
+  latestIcons(): Map<string, string> {
+    const held = new Map<string, string>();
+    for (const { name, versions } of this.listModules()) {
+      const latest = versions.filter((v) => !v.yanked).at(-1) ?? versions.at(-1);
+      if (latest?.icon) held.set(name, latest.icon);
+    }
+    return held;
+  }
+
   /**
    * Per-module download counter. Stored as a single integer in
    * `<dataDir>/downloads/<name>`. Read-modify-write, NOT atomic

package/src/container-manager.ts

@@ -614,20 +614,26 @@ function buildNetworkHandle(
       );
       // Give the box its fleet key BEFORE deploying, using the harness keypair.
       //
-      // `ensureFleetKey` (modules/celilo-mgmt/scripts/discovery.ts) mints a new
-      // `celilo-fleet` key under the state dir when none exists, and the deploy
-      // then sets `ssh.public_key` to it. In a real fleet that is right. In the
-      // rig it is not survivable: every target container trusts the HARNESS key,
-      // baked into authorized_keys at boot, and a freshly minted key is trusted
-      // by nothing. celilo would hold a key no machine accepts, and the next
-      // `machine add` fails with "no matching private key was found in ~/.ssh/"
-      // — which reads as a missing fixture and is actually a rotated key.
+      // `ensureFleetKey` (apps/celilo/src/services/fleet-key.ts, reached by the
+      // deploy through `celilo system ensure-fleet-key`) mints a new
+      // `celilo-fleet` key when none exists and records `ssh.public_key`. In a
+      // real fleet that is right. In the rig it is not survivable: every target
+      // container trusts the HARNESS key, baked into authorized_keys at boot,
+      // and a freshly minted key is trusted by nothing. celilo would hold a key
+      // no machine accepts, and the next `machine add` fails with "no matching
+      // private key was found in ~/.ssh/" — which reads as a missing fixture and
+      // is actually a rotated key.
       //
       // `ensureFleetKey` is idempotent and REUSES an existing key, so seeding it
       // with the harness pair means the deploy runs its real code path and
       // arrives at the key the fleet already trusts. This models an operator
       // whose management box already has its fleet key, which is the ordinary
       // case after the first deploy.
+      //
+      // The directory below must match `getFleetSshDir()`, which is
+      // `dirname(getDbPath())/.ssh`. The `db_path` set just above is what makes
+      // the two agree — the framework reads it from the env `on_install`
+      // exports before shelling out.
       const stateSshDir = '/root/.local/share/celilo/.ssh';
       dockerExec(
         projectName,