@celilo/e2e 0.6.0 → 0.6.2

package/src/container-manager.ts

@@ -1,10 +1,12 @@
-import { execSync, spawn, spawnSync, type ExecSyncOptions } from 'node:child_process';
-import { existsSync, writeFileSync } from 'node:fs';
-import { join, resolve } from 'node:path';
+import { type ExecSyncOptions, execSync, spawn } from 'node:child_process';
+import { copyFileSync, existsSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { basename, join, resolve } from 'node:path';
+import { SHARED_PROJECT_NAME, generateTestComposeYaml } from './docker-compose-generator';
+import { ensureSharedInfra } from './shared-infra';
+import { SIMULATOR_IPS } from './simulator-ips';
 import type { ExecResult, NetworkConfig, NetworkHandle } from './types';
 import { CeliloCommandError } from './types';
-import { generateTestComposeYaml, SHARED_PROJECT_NAME } from './docker-compose-generator';
-import { ensureSharedInfra } from './shared-infra';
 
 /** Package root — where docker/, config/, simulators/ live */
 const PACKAGE_ROOT = join(__dirname, '..');
@@ -58,18 +60,28 @@ const activeProjects: Set<string> = new Set();
 function cleanupOnExit() {
   for (const project of activeProjects) {
     try {
-      execSync(
-        `docker compose -p ${project} down --volumes --remove-orphans`,
-        { timeout: 30_000, stdio: 'pipe' },
-      );
+      execSync(`docker compose -p ${project} down --volumes --remove-orphans`, {
+        timeout: 30_000,
+        stdio: 'pipe',
+      });
     } catch {}
   }
-  try { execSync('docker network prune -f', { timeout: 10_000, stdio: 'pipe' }); } catch {}
+  try {
+    execSync('docker network prune -f', { timeout: 10_000, stdio: 'pipe' });
+  } catch {}
 }
 
-process.on('SIGTERM', () => { cleanupOnExit(); process.exit(1); });
-process.on('SIGINT', () => { cleanupOnExit(); process.exit(1); });
-process.on('beforeExit', () => { cleanupOnExit(); });
+process.on('SIGTERM', () => {
+  cleanupOnExit();
+  process.exit(1);
+});
+process.on('SIGINT', () => {
+  cleanupOnExit();
+  process.exit(1);
+});
+process.on('beforeExit', () => {
+  cleanupOnExit();
+});
 
 function run(cmd: string, opts?: ExecSyncOptions): string {
   return execSync(cmd, {
@@ -83,12 +95,75 @@ function run(cmd: string, opts?: ExecSyncOptions): string {
 const COMPOSE_FILE = 'docker-compose.test.yml';
 const SHARED_COMPOSE_FILE = 'docker-compose.shared.yml';
 
-/** Containers that live in the shared infra project, not the per-test project */
+/**
+ * Containers that live in the shared infra project, not the per-test project.
+ *
+ * CAVEAT: these names are matched globally — a per-test target-machine with
+ * any name in this set will be silently routed to the shared-infra container
+ * instead of its own. If you're adding a new e2e test machine, pick a name
+ * NOT in this set (e.g., use 'celilo-registry' for an LXC hosting the
+ * registry module rather than 'registry', which matches the shared stand-in).
+ */
 const SHARED_CONTAINERS = new Set([
-  'root-dns', 'tld-dns', 'namecheap-dns', 'letsencrypt', 'apt-cache',
+  'root-dns',
+  'tld-dns',
+  'namecheap-dns',
+  'letsencrypt',
+  'apt-cache',
+  'registry',
+  'isitup',
 ]);
 
-function dockerExec(projectName: string, composeDir: string, container: string, cmd: string, timeoutMs = 60_000): ExecResult {
+/**
+ * Scrub DNS zone files to baseline templates before a test starts.
+ *
+ * Copies slim template zones (containing only @, ns1, www) over the
+ * host-side zone files (which are bind-mounted into namecheap-dns),
+ * then reloads Knot to pick up the changes. This prevents DDNS-written
+ * subdomains from one test leaking into the next.
+ *
+ * Called automatically by startNetwork unless config.skipDnsScrub is
+ * set (useful for --keep debugging).
+ */
+async function scrubDnsZones(): Promise<void> {
+  const zones = ['iamtheinternet.org', 'lunacycle.net'];
+  const composeDir = PACKAGE_ROOT;
+
+  for (const zone of zones) {
+    const templatePath = join(PACKAGE_ROOT, 'config', 'dns', 'templates', `${zone}.zone`);
+    const liveZonePath = join(PACKAGE_ROOT, 'config', 'dns', `${zone}.zone`);
+
+    try {
+      // Copy template over the host-side zone file. The file is
+      // bind-mounted into the container, so overwriting the host file
+      // makes the new content available inside.
+      copyFileSync(templatePath, liveZonePath);
+    } catch (err) {
+      // Non-fatal: log and continue. The scrub is a hygiene measure;
+      // if it fails (template missing, permissions), tests can still run
+      // with stale DNS state.
+      console.warn(`[dns-scrub] Failed to copy ${zone} template: ${err}`);
+    }
+  }
+
+  // Reload all zones in one shot so Knot re-reads from the bind-mount
+  try {
+    run(
+      `docker compose -f ${SHARED_COMPOSE_FILE} -p ${SHARED_PROJECT_NAME} exec -T namecheap-dns knotc zone-reload`,
+      { cwd: composeDir },
+    );
+  } catch (err) {
+    console.warn(`[dns-scrub] Failed to reload zones: ${err}`);
+  }
+}
+
+function dockerExec(
+  projectName: string,
+  composeDir: string,
+  container: string,
+  cmd: string,
+  timeoutMs = 60_000,
+): ExecResult {
   // Use the shared infra project for shared containers
   const isShared = SHARED_CONTAINERS.has(container);
   const project = isShared ? SHARED_PROJECT_NAME : projectName;
@@ -121,8 +196,20 @@ function dockerExecAsync(
     // stdbuf -oL -eL forces line-buffered stdout and stderr so Ansible play/task
     // markers stream in real time rather than arriving in one burst at the end.
     const args = [
-      'compose', '-f', COMPOSE_FILE, '-p', projectName,
-      'exec', '-T', container, 'stdbuf', '-oL', '-eL', 'bash', '-c', cmd,
+      'compose',
+      '-f',
+      COMPOSE_FILE,
+      '-p',
+      projectName,
+      'exec',
+      '-T',
+      container,
+      'stdbuf',
+      '-oL',
+      '-eL',
+      'bash',
+      '-c',
+      cmd,
     ];
     const child = spawn('docker', args, { cwd: composeDir });
 
@@ -235,13 +322,13 @@ export async function startNetwork(config: NetworkConfig): Promise<NetworkHandle
   try {
     const running = run('docker ps --format "{{.Names}}" 2>/dev/null').split('\n').filter(Boolean);
     const heavyPatterns = ['authentik-', 'caddy-', 'build-your-own-internet-'];
-    const heavy = running.filter(name => heavyPatterns.some(p => name.startsWith(p)));
+    const heavy = running.filter((name) => heavyPatterns.some((p) => name.startsWith(p)));
     if (heavy.length > 0) {
-      const names = heavy.map(c => `   - ${c}`).join('\n');
+      const names = heavy.map((c) => `   - ${c}`).join('\n');
       throw new Error(
         `\nCannot start e2e tests: ${heavy.length} live container(s) are running:\n${names}\n\n` +
-        'Live and e2e environments are mutually exclusive.\n' +
-        'Stop live containers first: ./bin/e2e-down --all\n',
+          'Live and e2e environments are mutually exclusive.\n' +
+          'Stop live containers first: cele2e down --all\n',
       );
     }
   } catch (e) {
@@ -252,6 +339,13 @@ export async function startNetwork(config: NetworkConfig): Promise<NetworkHandle
   // This is idempotent — if already up, it just verifies health.
   await ensureSharedInfra();
 
+  // Scrub DNS zone files to baseline before each test (H5 in E2E_TEST_UPDATES.md).
+  // Prevents DDNS-written records from one test leaking into the next.
+  // Tests can opt out with config.skipDnsScrub (e.g., for --reuse debugging).
+  if (!config.skipDnsScrub) {
+    await scrubDnsZones();
+  }
+
   // Clean up stale per-test containers (self-healing from prior crashes)
   console.log('[progress:start] cleaning up stale test resources | cleanup complete');
   try {
@@ -267,14 +361,20 @@ export async function startNetwork(config: NetworkConfig): Promise<NetworkHandle
     try {
       const networks = run('docker network ls --format "{{.Name}}" 2>/dev/null')
         .split('\n')
-        .filter(n => n.startsWith('celilo-e2e-1')); // per-test projects start with timestamp
+        .filter((n) => n.startsWith('celilo-e2e-1')); // per-test projects start with timestamp
       if (networks.length > 0) {
-        const projects = [...new Set(networks.map(n => n.replace(/_[^_]+$/, '')))];
+        const projects = [...new Set(networks.map((n) => n.replace(/_[^_]+$/, '')))];
         for (const project of projects) {
-          try { run(`docker compose -p ${project} down --volumes --remove-orphans`, { timeout: 30_000 }); } catch {}
+          try {
+            run(`docker compose -p ${project} down --volumes --remove-orphans`, {
+              timeout: 30_000,
+            });
+          } catch {}
         }
         for (const net of networks) {
-          try { run(`docker network rm ${net}`, { timeout: 5_000 }); } catch {}
+          try {
+            run(`docker network rm ${net}`, { timeout: 5_000 });
+          } catch {}
         }
       }
     } catch {}
@@ -295,27 +395,63 @@ export async function startNetwork(config: NetworkConfig): Promise<NetworkHandle
   await streamingBuild(projectName, composeDir, COMPOSE_FILE);
 
   console.log('[progress:start] starting containers | containers running');
-  run(`docker compose -f ${COMPOSE_FILE} -p ${projectName} up -d`, { cwd: composeDir, timeout: 120_000 });
+  run(`docker compose -f ${COMPOSE_FILE} -p ${projectName} up -d`, {
+    cwd: composeDir,
+    timeout: 120_000,
+  });
 
   // Wait for DNS convergence (comcast-resolver is per-test, needs to reach shared DNS)
   console.log('[progress:start] waiting for DNS convergence | DNS converged');
   await waitFor(
     async () => {
-      const result = dockerExec(projectName, composeDir, 'comcast-resolver',
-        'dig @127.0.0.1 iamtheinternet.org NS +short +timeout=2');
+      const result = dockerExec(
+        projectName,
+        composeDir,
+        'comcast-resolver',
+        'dig @127.0.0.1 iamtheinternet.org NS +short +timeout=2',
+      );
       return result.exitCode === 0 && result.stdout.trim().length > 0;
     },
     60_000,
     'DNS convergence',
   );
 
+  // Wait for internal resolver (split-horizon DNS for management container).
+  // Skipped when the test specifies its own machine named `dns-int` — that
+  // means the test is replacing the infra resolver with a module under test
+  // (e.g., knot-unbound-internal). The bare target machine has no DNS server
+  // until its module deploys, so this wait would always time out. Management
+  // can still resolve names via the fallback `nameserver 100.100.0.1` in
+  // its resolv.conf during deploy.
+  const dnsIntReplaced = config.internalMachines.some((m) => m.name === 'dns-int');
+  if (!dnsIntReplaced) {
+    console.log('[progress:start] waiting for internal resolver | internal resolver ready');
+    await waitFor(
+      async () => {
+        const result = dockerExec(
+          projectName,
+          composeDir,
+          'dns-int',
+          'dig @127.0.0.1 iamtheinternet.org A +short +timeout=2',
+        );
+        return result.exitCode === 0 && result.stdout.trim().length > 0;
+      },
+      30_000,
+      'internal DNS resolver',
+    );
+  }
+
   // Optional routing verification
   if (config.verifyRouting) {
     console.log('[progress:start] verifying routing | routing verified');
     await waitFor(
       async () => {
-        const result = dockerExec(projectName, composeDir, 'management',
-          'ping -c1 -W2 100.64.0.53');
+        const result = dockerExec(
+          projectName,
+          composeDir,
+          'management',
+          `ping -c1 -W2 ${SIMULATOR_IPS.ROOT_DNS}`,
+        );
         return result.exitCode === 0;
       },
       30_000,
@@ -324,18 +460,32 @@ export async function startNetwork(config: NetworkConfig): Promise<NetworkHandle
   }
 
   // Wait for all target machines to complete setup (systemd boot + routing)
-  const allMachines = [...config.dmzMachines, ...config.appMachines, ...config.secureMachines, ...config.internalMachines];
+  const allMachines = [
+    ...config.dmzMachines,
+    ...config.appMachines,
+    ...config.secureMachines,
+    ...config.internalMachines,
+  ];
   if (allMachines.length > 0) {
     console.log('[progress:start] waiting for target machines | target machines ready');
   }
   for (const machine of allMachines) {
     await waitFor(
       async () => {
-        const result = dockerExec(projectName, composeDir, machine.name,
-          'systemctl is-active target-setup 2>/dev/null');
+        const result = dockerExec(
+          projectName,
+          composeDir,
+          machine.name,
+          'systemctl is-active target-setup 2>/dev/null',
+        );
         return result.stdout.trim() === 'active';
       },
-      30_000,
+      // App-zone machines use Dockerfile.target-machine-docker which bakes in
+      // dockerd; systemd boot + dockerd init takes ~25-35s, leaving a tight
+      // margin against a 30s timeout. 60s covers the observed worst case
+      // without slowing down dmz/internal-only tests (which still hit this
+      // in ~2-5s).
+      60_000,
       `${machine.name} target-setup`,
     );
   }
@@ -345,8 +495,12 @@ export async function startNetwork(config: NetworkConfig): Promise<NetworkHandle
     console.log('[progress:start] waiting for DHCP client lease | DHCP lease acquired');
     await waitFor(
       async () => {
-        const result = dockerExec(projectName, composeDir, 'dhcp-client',
-          'test -f /var/lib/dhcp/dhclient.leases && grep -c lease /var/lib/dhcp/dhclient.leases');
+        const result = dockerExec(
+          projectName,
+          composeDir,
+          'dhcp-client',
+          'test -f /var/lib/dhcp/dhclient.leases && grep -c lease /var/lib/dhcp/dhclient.leases',
+        );
         return result.exitCode === 0 && Number.parseInt(result.stdout.trim()) > 0;
       },
       60_000,
@@ -358,8 +512,12 @@ export async function startNetwork(config: NetworkConfig): Promise<NetworkHandle
   if (allMachines.length > 0) {
     await waitFor(
       async () => {
-        const result = dockerExec(projectName, composeDir, 'management',
-          'ping -c1 -W2 100.64.0.100');
+        const result = dockerExec(
+          projectName,
+          composeDir,
+          'management',
+          `ping -c1 -W2 ${SIMULATOR_IPS.PEBBLE}`,
+        );
         return result.exitCode === 0;
       },
       30_000,
@@ -369,14 +527,18 @@ export async function startNetwork(config: NetworkConfig): Promise<NetworkHandle
 
   // Initialize celilo
   console.log('[progress:start] initializing celilo | celilo initialized');
-  const initResult = dockerExec(projectName, composeDir, 'management',
+  const initResult = dockerExec(
+    projectName,
+    composeDir,
+    'management',
     `celilo system init --accept-defaults \
       network.dmz.subnet=10.0.10.0/24 \
       network.app.subnet=10.0.20.0/24 \
       network.secure.subnet=10.0.30.0/24 \
       network.internal.subnet=192.168.0.0/24 \
       dns.primary=100.100.0.1 \
-      dns.fallback=1.0.0.1,8.8.8.8`);
+      dns.fallback=1.0.0.1,8.8.8.8`,
+  );
   if (initResult.exitCode !== 0) {
     throw new Error(`Celilo init failed: ${initResult.stderr}`);
   }
@@ -388,12 +550,21 @@ export async function startNetwork(config: NetworkConfig): Promise<NetworkHandle
   const handle: NetworkHandle = {
     projectName,
 
-    async celilo(cmd: string, optsOrTimeout?: number | { check?: boolean; timeoutMs?: number }): Promise<ExecResult> {
+    async celilo(
+      cmd: string,
+      optsOrTimeout?: number | { check?: boolean; timeoutMs?: number },
+    ): Promise<ExecResult> {
       const check = typeof optsOrTimeout === 'object' ? (optsOrTimeout.check ?? true) : true;
-      const timeoutMs = typeof optsOrTimeout === 'number' ? optsOrTimeout : (optsOrTimeout?.timeoutMs ?? 120_000);
-
-      const result = await dockerExecAsync(projectName, composeDir, 'management',
-        `celilo ${cmd}`, timeoutMs);
+      const timeoutMs =
+        typeof optsOrTimeout === 'number' ? optsOrTimeout : (optsOrTimeout?.timeoutMs ?? 120_000);
+
+      const result = await dockerExecAsync(
+        projectName,
+        composeDir,
+        'management',
+        `celilo ${cmd}`,
+        timeoutMs,
+      );
 
       if (check && result.exitCode !== 0) {
         throw new CeliloCommandError(cmd, result);
@@ -406,9 +577,12 @@ export async function startNetwork(config: NetworkConfig): Promise<NetworkHandle
     },
 
     async dig(name: string): Promise<string> {
-      const result = dockerExec(projectName, composeDir, 'management',
-        `dig +short ${name}`);
-      return result.stdout.trim();
+      const result = dockerExec(projectName, composeDir, 'management', `dig +short ${name}`);
+      return result.stdout
+        .split('\n')
+        .filter((l) => !l.startsWith(';;'))
+        .join('\n')
+        .trim();
     },
 
     async debug(container = 'management'): Promise<void> {
@@ -424,28 +598,78 @@ export async function startNetwork(config: NetworkConfig): Promise<NetworkHandle
       const start = Date.now();
       const timeout = 86_400_000; // 24 hour max debug session
       while (!existsSync(signalFile) && Date.now() - start < timeout) {
-        await new Promise(r => setTimeout(r, 500));
+        await new Promise((r) => setTimeout(r, 500));
       }
 
       // Clean up
-      try { require('node:fs').unlinkSync(signalFile); } catch {}
+      try {
+        require('node:fs').unlinkSync(signalFile);
+      } catch {}
 
       console.log('[debug:resumed]');
     },
 
     waitFor,
 
+    async publishModule(localPath: string): Promise<void> {
+      const absPath = resolve(localPath);
+      const isNetapp = absPath.endsWith('.netapp');
+      const moduleId = isNetapp ? basename(absPath).slice(0, -7) : basename(absPath);
+
+      let netappPath: string;
+      let cleanup = false;
+
+      if (isNetapp) {
+        netappPath = absPath;
+      } else {
+        // Package the module source directory using the celilo CLI
+        netappPath = join(tmpdir(), `${moduleId}-${Date.now()}.netapp`);
+        cleanup = true;
+        const celiloCliPath = join(celiloRoot ?? PACKAGE_ROOT, 'apps/celilo/src/cli/index.ts');
+        try {
+          run(
+            `bun run ${JSON.stringify(celiloCliPath)} package ${JSON.stringify(absPath)} --output ${JSON.stringify(netappPath)}`,
+            { timeout: 60_000 },
+          );
+        } catch (err) {
+          throw new Error(`Failed to package module at ${absPath}: ${String(err)}`);
+        }
+      }
+
+      try {
+        // Copy directly into the registry container's /uploads dir.
+        // The registry rebuilds its index on every request, so no HTTP handshake needed.
+        run(
+          `docker compose -f ${SHARED_COMPOSE_FILE} -p ${SHARED_PROJECT_NAME} cp ${JSON.stringify(netappPath)} registry:/uploads/${moduleId}.netapp`,
+          { cwd: composeDir, timeout: 120_000 },
+        );
+      } finally {
+        if (cleanup)
+          try {
+            execSync(`rm -f ${JSON.stringify(netappPath)}`, { stdio: 'pipe' });
+          } catch {}
+      }
+    },
+
+    async configureAcme(): Promise<void> {
+      await handle.celilo(
+        'module config set caddy acme_ca https://acme-v02.api.letsencrypt.org/dir',
+      );
+    },
+
     async stop(): Promise<void> {
       // Respect --keep / --reuse: don't tear down the network
       if (process.env.CELILO_E2E_KEEP === '1' || process.env.CELILO_E2E_REUSE === '1') {
         console.log(`[progress:done] network kept alive (project: ${projectName})`);
-        activeProjects.delete(projectName);  // don't re-teardown on exit
+        activeProjects.delete(projectName); // don't re-teardown on exit
         return;
       }
       console.log('[progress:start] stopping network | network stopped');
       try {
-        run(`docker compose -f ${COMPOSE_FILE} -p ${projectName} down --volumes --remove-orphans`,
-          { cwd: composeDir, timeout: 60_000 });
+        run(`docker compose -f ${COMPOSE_FILE} -p ${projectName} down --volumes --remove-orphans`, {
+          cwd: composeDir,
+          timeout: 60_000,
+        });
       } catch {
         // Best effort cleanup
       }
@@ -469,17 +693,17 @@ export function reconnectNetwork(projectName: string): NetworkHandle {
 
   // Verify the project actually exists
   try {
-    const result = run(
-      `docker compose -f ${COMPOSE_FILE} -p ${projectName} ps -q`,
-      { cwd: composeDir, timeout: 10_000 },
-    );
+    const result = run(`docker compose -f ${COMPOSE_FILE} -p ${projectName} ps -q`, {
+      cwd: composeDir,
+      timeout: 10_000,
+    });
     if (!result.trim()) {
       throw new Error(`No containers found for project ${projectName}`);
     }
   } catch (err) {
     throw new Error(
       `Cannot reconnect to network '${projectName}': ${err instanceof Error ? err.message : String(err)}\n` +
-      `Fix: Run without --reuse to create a fresh network, or check if containers were torn down.`,
+        `Fix: Run without --reuse to create a fresh network, or check if containers were torn down.`,
     );
   }
 
@@ -490,12 +714,21 @@ export function reconnectNetwork(projectName: string): NetworkHandle {
   return {
     projectName,
 
-    async celilo(cmd: string, optsOrTimeout?: number | { check?: boolean; timeoutMs?: number }): Promise<ExecResult> {
+    async celilo(
+      cmd: string,
+      optsOrTimeout?: number | { check?: boolean; timeoutMs?: number },
+    ): Promise<ExecResult> {
       const check = typeof optsOrTimeout === 'object' ? (optsOrTimeout.check ?? true) : true;
-      const timeoutMs = typeof optsOrTimeout === 'number' ? optsOrTimeout : (optsOrTimeout?.timeoutMs ?? 120_000);
-
-      const result = await dockerExecAsync(projectName, composeDir, 'management',
-        `celilo ${cmd}`, timeoutMs);
+      const timeoutMs =
+        typeof optsOrTimeout === 'number' ? optsOrTimeout : (optsOrTimeout?.timeoutMs ?? 120_000);
+
+      const result = await dockerExecAsync(
+        projectName,
+        composeDir,
+        'management',
+        `celilo ${cmd}`,
+        timeoutMs,
+      );
 
       if (check && result.exitCode !== 0) {
         throw new CeliloCommandError(cmd, result);
@@ -508,9 +741,12 @@ export function reconnectNetwork(projectName: string): NetworkHandle {
     },
 
     async dig(name: string): Promise<string> {
-      const result = dockerExec(projectName, composeDir, 'management',
-        `dig +short ${name}`);
-      return result.stdout.trim();
+      const result = dockerExec(projectName, composeDir, 'management', `dig +short ${name}`);
+      return result.stdout
+        .split('\n')
+        .filter((l) => !l.startsWith(';;'))
+        .join('\n')
+        .trim();
     },
 
     async debug(container = 'management'): Promise<void> {
@@ -519,14 +755,63 @@ export function reconnectNetwork(projectName: string): NetworkHandle {
       const start = Date.now();
       const timeout = 86_400_000;
       while (!existsSync(signalFile) && Date.now() - start < timeout) {
-        await new Promise(r => setTimeout(r, 500));
+        await new Promise((r) => setTimeout(r, 500));
       }
-      try { require('node:fs').unlinkSync(signalFile); } catch {}
+      try {
+        require('node:fs').unlinkSync(signalFile);
+      } catch {}
       console.log('[debug:resumed]');
     },
 
     waitFor,
 
+    async configureAcme(): Promise<void> {
+      await handle.celilo(
+        'module config set caddy acme_ca https://acme-v02.api.letsencrypt.org/dir',
+      );
+    },
+
+    async publishModule(localPath: string): Promise<void> {
+      const absPath = resolve(localPath);
+      const isNetapp = absPath.endsWith('.netapp');
+      const moduleId = isNetapp ? basename(absPath).slice(0, -7) : basename(absPath);
+
+      let netappPath: string;
+      let cleanup = false;
+
+      if (isNetapp) {
+        netappPath = absPath;
+      } else {
+        netappPath = join(tmpdir(), `${moduleId}-${Date.now()}.netapp`);
+        cleanup = true;
+        const resolvedCeliloRoot = findCeliloRoot();
+        const celiloCliPath = join(
+          resolvedCeliloRoot ?? PACKAGE_ROOT,
+          'apps/celilo/src/cli/index.ts',
+        );
+        try {
+          run(
+            `bun run ${JSON.stringify(celiloCliPath)} package ${JSON.stringify(absPath)} --output ${JSON.stringify(netappPath)}`,
+            { timeout: 60_000 },
+          );
+        } catch (err) {
+          throw new Error(`Failed to package module at ${absPath}: ${String(err)}`);
+        }
+      }
+
+      try {
+        run(
+          `docker compose -f ${SHARED_COMPOSE_FILE} -p ${SHARED_PROJECT_NAME} cp ${JSON.stringify(netappPath)} registry:/uploads/${moduleId}.netapp`,
+          { cwd: composeDir, timeout: 120_000 },
+        );
+      } finally {
+        if (cleanup)
+          try {
+            execSync(`rm -f ${JSON.stringify(netappPath)}`, { stdio: 'pipe' });
+          } catch {}
+      }
+    },
+
     async stop(): Promise<void> {
       // Respect --keep / --reuse: don't tear down
       if (process.env.CELILO_E2E_KEEP === '1' || process.env.CELILO_E2E_REUSE === '1') {
@@ -535,8 +820,10 @@ export function reconnectNetwork(projectName: string): NetworkHandle {
         return;
       }
       try {
-        run(`docker compose -f ${COMPOSE_FILE} -p ${projectName} down --volumes --remove-orphans`,
-          { cwd: composeDir, timeout: 60_000 });
+        run(`docker compose -f ${COMPOSE_FILE} -p ${projectName} down --volumes --remove-orphans`, {
+          cwd: composeDir,
+          timeout: 60_000,
+        });
       } catch {}
       activeProjects.delete(projectName);
     },