@celilo/e2e 0.7.14 → 0.7.15

package/config/dns/knot-namecheap.conf

@@ -10,8 +10,8 @@ zone:
     file: "/config/celilo.computer.zone"
     storage: "/var/lib/knot"
 
-  - domain: "lunacycle.net"
-    file: "/config/lunacycle.net.zone"
+  - domain: "example.net"
+    file: "/config/example.net.zone"
     storage: "/var/lib/knot"
 
   - domain: "park-your-domain.com"

package/config/dns/net.zone

@@ -7,5 +7,5 @@ $TTL 86400
 
 net.                    IN NS   tld-dns.lab.
 
-lunacycle               IN NS   ns1.lunacycle.net.
-ns1.lunacycle.net.      IN A    100.64.0.55
+example                 IN NS   ns1.example.net.
+ns1.example.net.      IN A    100.64.0.55

package/config/dns/{lunacycle.net.zone → templates/example.net.zone}

@@ -1,7 +1,7 @@
-$ORIGIN lunacycle.net.
+$ORIGIN example.net.
 $TTL 300
 
-@ IN SOA ns1.lunacycle.net. admin.lunacycle.net. (
+@ IN SOA ns1.example.net. admin.example.net. (
     2024020108 300 60 604800 300
 )
 
@@ -10,7 +10,7 @@ $TTL 300
 ; private IPs are unreachable from outside. All public-facing names
 ; resolve to the firewall's external IP (100.100.0.100), which DNATs
 ; inbound to the right internal host.
-@       IN NS   ns1.lunacycle.net.
+@       IN NS   ns1.example.net.
 ns1     IN A    100.64.0.55
 @       IN A    100.100.0.100
 www     IN A    100.100.0.100

package/config/resolver/unbound.conf

@@ -34,11 +34,11 @@ stub-zone:
     stub-addr: 100.64.0.55
 
 stub-zone:
-    name: "lunacycle.net."
+    name: "example.net."
     stub-addr: 100.64.0.55
 
 # celilo.computer hosts the website + install.sh (served by the website-sim).
-# Without this stub it falls through to the real internet (71.36.115.155), so the
+# Without this stub it falls through to the real internet (203.0.113.11), so the
 # website-sim's ACME challenge can't be validated in-topology and the bake's
 # `curl https://celilo.computer/install.sh` never sees a cert. Covers
 # www.celilo.computer too. (ISS-0063)

package/config/routing/observer-setup.sh

@@ -0,0 +1,60 @@
+#!/bin/bash
+# Observer vantage setup (ISS-0117).
+#
+# Installs the routing profile that makes this container a FAITHFUL vantage — the
+# load-bearing part of the framework. A vantage's correctness is its routing table:
+# an internalDevice must reach a fronted service only via the firewall natIp, never a
+# segmented-zone container IP directly. Driven by env from the compose generator:
+#   OBSERVER_GATEWAY   - default route (the home router for internalDevice, the zone
+#                        firewall for dmz/app/secure, fw-ext for publicInternet)
+#   OBSERVER_INTERZONE - "1" to add the management-style explicit inter-zone routes
+#                        (the all-VLAN trap). "0" for every faithful consumer vantage.
+#   OBSERVER_RESOLVERS - space-separated nameservers for /etc/resolv.conf, in order
+set -u
+
+GATEWAY="${OBSERVER_GATEWAY:?OBSERVER_GATEWAY is required}"
+INTERZONE="${OBSERVER_INTERZONE:-0}"
+RESOLVERS="${OBSERVER_RESOLVERS:-100.100.0.1}"
+
+echo "Observer starting: gateway=${GATEWAY} interzone=${INTERZONE} resolvers='${RESOLVERS}'"
+
+# --- Default route ---
+# Docker seeds a default via the network's own gateway; replace it with the gateway a
+# real device at this location would use.
+ip route del default 2>/dev/null || true
+ip route add default via "${GATEWAY}"
+
+# --- Inter-zone routes (the management trap; only when explicitly requested) ---
+# A real consumer vantage NEVER has these — that is the whole point. Present only so a
+# `management`-style all-VLAN box can be modelled deliberately.
+if [ "${INTERZONE}" = "1" ]; then
+  ip route add 10.0.10.0/24 via 192.168.0.254 2>/dev/null || true  # dmz via fw-main
+  ip route add 10.0.20.0/24 via 192.168.0.254 2>/dev/null || true  # app via fw-main
+  ip route add 10.0.30.0/24 via 192.168.0.254 2>/dev/null || true  # secure via fw-main
+fi
+
+# --- Resolver ---
+: > /etc/resolv.conf
+for ns in ${RESOLVERS}; do
+  echo "nameserver ${ns}" >> /etc/resolv.conf
+done
+
+# --- Pebble runtime ACME root CA ---
+# Pebble mints a fresh root each startup, so the build-time CA can't verify certs Caddy
+# obtained at runtime. Fetch the live root so curl/openssl can validate real chains —
+# the no-self-signed / CA-provenance assertions depend on a correct trust store.
+echo "Fetching Pebble ACME root CA..."
+for _ in $(seq 1 30); do
+  if curl -sk https://100.64.0.100:15000/roots/0 -o /usr/local/share/ca-certificates/pebble-acme-root.crt 2>/dev/null; then
+    if [ -s /usr/local/share/ca-certificates/pebble-acme-root.crt ]; then
+      update-ca-certificates 2>/dev/null
+      echo "Pebble ACME root CA installed"
+      break
+    fi
+  fi
+  sleep 2
+done
+
+echo "Observer ready: $(hostname)"
+ip route
+sleep infinity

package/config/routing/resolver-internal-routes.sh

@@ -9,9 +9,9 @@ CADDY_IP="${CADDY_IP:-10.0.10.10}"
 # DOMAINS: comma-separated list of e2e test domains that should be
 # split-horizon redirected to caddy. Default covers the canonical
 # (iamtheinternet.org) plus the cross-domain test's second domain
-# (lunacycle.net). Tests can override via DEFAULT_GATEWAY/DOMAINS env
+# (example.net). Tests can override via DEFAULT_GATEWAY/DOMAINS env
 # vars in docker-compose.
-DOMAINS="${DOMAINS:-iamtheinternet.org,lunacycle.net}"
+DOMAINS="${DOMAINS:-iamtheinternet.org,example.net}"
 
 # Routing — reach comcast-resolver (100.100.0.1) via fw-main or fw-isp.
 # DEFAULT_GATEWAY is set by docker-compose from the topology config.

package/docker/Dockerfile.observer

@@ -0,0 +1,26 @@
+# Observer — a passive vantage-point spy (ISS-0117).
+#
+# Carries the full probe toolbox (dig, curl, openssl, nc, ping, ip) so a single image
+# can be injected at any network location and assert resolve/reach/TLS from that seat.
+# It runs NO services and deploys NO modules — it never perturbs the system under test.
+# Its faithfulness as a vantage comes from the routing profile installed at startup
+# (see config/routing/observer-setup.sh), driven by the OBSERVER_* env the compose
+# generator sets per vantage.
+FROM ubuntu:22.04
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+RUN apt-get update && apt-get install -y \
+    dnsutils \
+    curl \
+    openssl \
+    netcat-openbsd \
+    iputils-ping \
+    iproute2 \
+    ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY config/routing/observer-setup.sh /startup.sh
+RUN chmod +x /startup.sh
+
+CMD ["/startup.sh"]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@celilo/e2e",
-  "version": "0.7.14",
+  "version": "0.7.15",
   "description": "E2E test infrastructure for Celilo-deployed applications. Provides a simulated internet with DNS hierarchy, ACME server, firewalls, and target machines in Docker.",
   "type": "module",
   "main": "./src/index.ts",
@@ -37,7 +37,7 @@
   ],
   "dependencies": {
     "@celilo/cli-display": "^0.1.9",
-    "@celilo/event-bus": "^0.1.6",
+    "@celilo/event-bus": "^0.1.7",
     "yaml": "^2.8.0",
     "zod": "^3.24.1"
   },

package/src/container-manager.ts

@@ -16,7 +16,7 @@ import type {
   ProxyOptions,
   SocksProxyHandle,
 } from './types';
-import { CeliloCommandError, ZONE_GATEWAYS, ZONE_SUBNETS } from './types';
+import { CeliloCommandError, internalNatIp, ZONE_GATEWAYS, ZONE_SUBNETS } from './types';
 
 /** Package root — where docker/, config/, simulators/ live */
 const PACKAGE_ROOT = join(__dirname, '..');
@@ -137,7 +137,7 @@ const SHARED_CONTAINERS = new Set([
  * set (useful for --keep debugging).
  */
 async function scrubDnsZones(): Promise<void> {
-  const zones = ['iamtheinternet.org', 'lunacycle.net'];
+  const zones = ['iamtheinternet.org', 'example.net'];
   const composeDir = PACKAGE_ROOT;
 
   for (const zone of zones) {
@@ -675,7 +675,7 @@ export async function startNetwork(config: NetworkConfig): Promise<NetworkHandle
     async deployFirewall(opts = {}): Promise<void> {
       const zones = opts.zones ?? ['dmz', 'app', 'secure'];
       const firewallIp = ZONE_GATEWAYS.internal; // fw-main on internal
-      const natIp = opts.natIp ?? '192.168.0.253';
+      const natIp = opts.natIp ?? internalNatIp();
       const providedNetworks = zones.map((zone) => ({
         zone,
         subnet: ZONE_SUBNETS[zone],
@@ -950,7 +950,7 @@ export function reconnectNetwork(projectName: string): NetworkHandle {
     async deployFirewall(opts = {}): Promise<void> {
       const zones = opts.zones ?? ['dmz', 'app', 'secure'];
       const firewallIp = ZONE_GATEWAYS.internal; // fw-main on internal
-      const natIp = opts.natIp ?? '192.168.0.253';
+      const natIp = opts.natIp ?? internalNatIp();
       const providedNetworks = zones.map((zone) => ({
         zone,
         subnet: ZONE_SUBNETS[zone],

package/src/docker-compose-generator.ts

@@ -1,6 +1,7 @@
 import { existsSync } from 'node:fs';
 import { join } from 'node:path';
 import { stringify } from 'yaml';
+import { normalizeObservers, observerEnv, observerPlacement } from './observer';
 import { SIMULATOR_IPS } from './simulator-ips';
 import type { MachineSpec, NetworkConfig, TopologyPreset } from './types';
 import { ZONE_GATEWAYS } from './types';
@@ -216,7 +217,7 @@ export function generateSharedInfraYaml(): string {
     // `test123` still applies to any domain not listed.
     environment: {
       DDNS_PASSWORDS:
-        '{"iamtheinternet.org":"test123","celilo.computer":"test456","lunacycle.net":"test789"}',
+        '{"iamtheinternet.org":"test123","celilo.computer":"test456","example.net":"test789"}',
     },
     volumes: [
       './config/dns/knot-namecheap.conf:/config/knot.conf:ro',
@@ -227,7 +228,7 @@ export function generateSharedInfraYaml(): string {
       // namecheap-startup.sh for the full rationale).
       './config/dns/iamtheinternet.org.zone:/seed/iamtheinternet.org.zone:ro',
       './config/dns/celilo.computer.zone:/seed/celilo.computer.zone:ro',
-      './config/dns/lunacycle.net.zone:/seed/lunacycle.net.zone:ro',
+      './config/dns/example.net.zone:/seed/example.net.zone:ro',
       './config/dns/park-your-domain.com.zone:/seed/park-your-domain.com.zone:ro',
     ],
   });
@@ -504,6 +505,20 @@ export function generateTestComposeYaml(config: NetworkConfig, celiloRoot?: stri
     });
   }
 
+  // --- Observer vantages (passive spies; ISS-0117) ---
+  // Each is the SAME image at a different network location with a routing profile that
+  // mirrors a real device there — that routing profile is what makes it a faithful seat
+  // to assert from, rather than the all-VLAN management trap.
+  for (const spec of normalizeObservers(config.observers ?? [])) {
+    const p = observerPlacement(spec.vantage);
+    services[p.service] = baseService({
+      build: { context: '.', dockerfile: 'docker/Dockerfile.observer' },
+      networks: { [p.network]: { ipv4_address: p.ip } },
+      cap_add: ['NET_ADMIN'],
+      environment: observerEnv(p),
+    });
+  }
+
   const compose = { networks, volumes, services };
   return stringify(compose, { lineWidth: 120 });
 }
@@ -619,7 +634,7 @@ export function generateComposeYaml(config: NetworkConfig, celiloRoot = '..'): s
     // `test123` still applies to any domain not listed.
     environment: {
       DDNS_PASSWORDS:
-        '{"iamtheinternet.org":"test123","celilo.computer":"test456","lunacycle.net":"test789"}',
+        '{"iamtheinternet.org":"test123","celilo.computer":"test456","example.net":"test789"}',
     },
     volumes: [
       './config/dns/knot-namecheap.conf:/config/knot.conf:ro',
@@ -630,7 +645,7 @@ export function generateComposeYaml(config: NetworkConfig, celiloRoot = '..'): s
       // namecheap-startup.sh for the full rationale).
       './config/dns/iamtheinternet.org.zone:/seed/iamtheinternet.org.zone:ro',
       './config/dns/celilo.computer.zone:/seed/celilo.computer.zone:ro',
-      './config/dns/lunacycle.net.zone:/seed/lunacycle.net.zone:ro',
+      './config/dns/example.net.zone:/seed/example.net.zone:ro',
       './config/dns/park-your-domain.com.zone:/seed/park-your-domain.com.zone:ro',
     ],
   });

package/src/index.ts

@@ -37,6 +37,8 @@ export type {
   ExecResult,
   MachineSpec,
   Zone,
+  Vantage,
+  ObserverSpec,
   TopologyPreset,
   ProxyOptions,
   SocksProxyHandle,
@@ -44,7 +46,32 @@ export type {
   BrowserHandle,
   BrowserLauncher,
 } from './types';
-export { CeliloCommandError, ZONE_GATEWAYS, ZONE_SUBNETS } from './types';
+export {
+  CeliloCommandError,
+  greenwaveRouterIp,
+  internalNatIp,
+  internalResolverIp,
+  publicResolverIp,
+  ZONE_GATEWAYS,
+  ZONE_SUBNETS,
+} from './types';
+
+// Vantage-point network assertions (ISS-0117)
+export { VantageProbe, VantageAssertionError } from './vantage';
+export type {
+  ProbeTransport,
+  ResolveMethod,
+  ResolveResult,
+  HttpsResult,
+  CertInfo,
+  ResolutionInspection,
+  ExpectedZone,
+} from './vantage';
+export { createObserverTransport, vantageContainer, OBSERVER_PLACEMENTS } from './observer';
+export { classifyIp, isSegmentedZoneIp, isPublicLeakSafe } from './zone-classifier';
+export type { ZoneClass } from './zone-classifier';
+export { assertFrontedServicePositives, assertFrontedHostnames } from './vantage-helpers';
+export type { FrontedServiceExpectation } from './vantage-helpers';
 
 // Common fixtures
 export {

package/src/network-builder.ts

@@ -2,7 +2,7 @@ import { execSync } from 'node:child_process';
 import { existsSync } from 'node:fs';
 import { join } from 'node:path';
 import { startNetwork } from './container-manager';
-import type { NetworkConfig, NetworkHandle, TopologyPreset } from './types';
+import type { NetworkConfig, NetworkHandle, TopologyPreset, Vantage } from './types';
 
 /**
  * If a mounted path looks like a celilo module (has scripts/package.json),
@@ -39,6 +39,7 @@ export class NetworkBuilder {
     secureMachines: [],
     internalMachines: [],
     dhcpClient: false,
+    observers: [],
     domain: 'iamtheinternet.org',
     ddnsPassword: 'test123',
     verifyRouting: process.env.VERIFY_ROUTING === '1',
@@ -104,6 +105,22 @@ export class NetworkBuilder {
     return this;
   }
 
+  /**
+   * Inject one or more observer vantages (ISS-0117) — passive spies carrying the probe
+   * toolbox, each placed at its vantage's network location with a routing profile that
+   * mirrors a real device there. Drive them via `createObserverTransport(handle)` +
+   * `VantageProbe`. `management` is not injectable (that vantage reuses the real
+   * management container).
+   *
+   *   network().dmz({ caddy: '10.0.10.10' }).observe('internalDevice', 'publicInternet')
+   */
+  observe(...vantages: Vantage[]): this {
+    for (const vantage of vantages) {
+      (this.config.observers ??= []).push({ vantage });
+    }
+    return this;
+  }
+
   domain(domain: string): this {
     this.config.domain = domain;
     return this;

package/src/observer.test.ts

@@ -0,0 +1,155 @@
+import { describe, expect, test } from 'bun:test';
+import {
+  createObserverTransport,
+  normalizeObservers,
+  OBSERVER_PLACEMENTS,
+  observerEnv,
+  vantageContainer,
+} from './observer';
+import type { ExecResult, NetworkHandle } from './types';
+import { ZONE_GATEWAYS } from './types';
+
+/** A NetworkHandle whose `exec` records calls and returns scripted results. */
+function fakeHandle(script: (container: string, cmd: string) => Partial<ExecResult>) {
+  const calls: { container: string; cmd: string }[] = [];
+  const exec = (container: string, cmd: string): Promise<ExecResult> => {
+    calls.push({ container, cmd });
+    return Promise.resolve({ stdout: '', stderr: '', exitCode: 0, ...script(container, cmd) });
+  };
+  return { handle: { exec } as unknown as NetworkHandle, calls };
+}
+
+describe('placement faithfulness (the load-bearing invariants)', () => {
+  test('internalDevice routes via the home router, NOT fw-main, and has no inter-zone routes', () => {
+    const p = OBSERVER_PLACEMENTS.internalDevice;
+    expect(p.network).toBe('internal');
+    expect(p.interZoneRoutes).toBe(false);
+    // The whole point: default route is the LAN's home router, never ZONE_GATEWAYS.internal
+    // (fw-main), which would hand it a path into the segmented zones.
+    expect(p.gateway).not.toBe(ZONE_GATEWAYS.internal);
+  });
+
+  test('no injectable observer carries inter-zone routes (only the management trap would)', () => {
+    for (const p of Object.values(OBSERVER_PLACEMENTS)) {
+      expect(p.interZoneRoutes).toBe(false);
+    }
+  });
+
+  test('segmented-zone observer IPs derive from their zone gateway (no pinned subnets)', () => {
+    expect(OBSERVER_PLACEMENTS.dmzSystem.gateway).toBe(ZONE_GATEWAYS.dmz);
+    expect(OBSERVER_PLACEMENTS.dmzSystem.ip).toBe(ZONE_GATEWAYS.dmz.replace(/\.\d+$/, '.240'));
+    expect(OBSERVER_PLACEMENTS.secureSystem.ip).toBe(ZONE_GATEWAYS.secure.replace(/\.\d+$/, '.240'));
+  });
+
+  test('publicInternet uses only the public resolver (never the internal split-horizon view)', () => {
+    expect(OBSERVER_PLACEMENTS.publicInternet.resolvers).toEqual(['100.100.0.1']);
+  });
+
+  test('observerEnv serializes the routing profile for the setup script', () => {
+    const env = observerEnv(OBSERVER_PLACEMENTS.internalDevice);
+    expect(env.OBSERVER_INTERZONE).toBe('0');
+    expect(env.OBSERVER_GATEWAY).toBe(OBSERVER_PLACEMENTS.internalDevice.gateway);
+    expect(env.OBSERVER_RESOLVERS).toContain('100.100.0.1');
+  });
+});
+
+describe('normalizeObservers + vantageContainer', () => {
+  test('dedupes and rejects management as an injectable observer', () => {
+    expect(normalizeObservers([{ vantage: 'internalDevice' }, { vantage: 'internalDevice' }])).toHaveLength(1);
+    expect(() => normalizeObservers([{ vantage: 'management' }])).toThrow(/management/);
+  });
+  test('management vantage maps to the real management container; others to observers', () => {
+    expect(vantageContainer('management')).toBe('management');
+    expect(vantageContainer('internalDevice')).toBe(OBSERVER_PLACEMENTS.internalDevice.service);
+  });
+});
+
+describe('observer transport — parsing + container targeting', () => {
+  test('resolve(system) parses getent first column and targets the right observer', async () => {
+    const { handle, calls } = fakeHandle((_c, cmd) =>
+      cmd.startsWith('getent') ? { stdout: '192.168.0.253  www.iamtheinternet.org' } : {},
+    );
+    const t = createObserverTransport(handle);
+    const r = await t.resolve({ from: 'internalDevice', name: 'www.iamtheinternet.org', method: 'system' });
+    expect(r.ips).toEqual(['192.168.0.253']);
+    expect(calls[0].container).toBe('observer-internal');
+  });
+
+  test('resolve(dns) with explicit server', async () => {
+    const { handle, calls } = fakeHandle((_c, cmd) => (cmd.includes('dig') ? { stdout: '10.0.10.10\n' } : {}));
+    const t = createObserverTransport(handle);
+    const r = await t.resolve({ from: 'dmzSystem', name: 'auth.x', method: 'dns', server: '192.168.0.10' });
+    expect(r.ips).toEqual(['10.0.10.10']);
+    expect(calls[0].cmd).toContain('@192.168.0.10');
+  });
+
+  test('resolve(hostfiles) parses /etc/hosts first column', async () => {
+    const { handle } = fakeHandle((_c, cmd) =>
+      cmd.startsWith('grep -F') ? { stdout: '10.0.10.10 auth.iamtheinternet.org' } : {},
+    );
+    const t = createObserverTransport(handle);
+    const r = await t.resolve({ from: 'dmzSystem', name: 'auth.iamtheinternet.org', method: 'hostfiles' });
+    expect(r.ips).toEqual(['10.0.10.10']);
+  });
+
+  test('tcpConnect maps the container exit code', async () => {
+    const { handle } = fakeHandle((_c, cmd) => ({ exitCode: cmd.includes('443') ? 0 : 1 }));
+    const t = createObserverTransport(handle);
+    expect((await t.tcpConnect({ from: 'internalDevice', host: '192.168.0.253', port: 443 })).connected).toBe(true);
+    expect((await t.tcpConnect({ from: 'internalDevice', host: '10.0.10.10', port: 22 })).connected).toBe(false);
+  });
+
+  test('httpsRequest parses cert (CN/issuer/SAN/selfSigned) + status', async () => {
+    const { handle } = fakeHandle((_c, cmd) => {
+      if (cmd.includes('openssl s_client')) {
+        return {
+          stdout:
+            'subject=CN = deathstar.iamtheinternet.org\n' +
+            'issuer=CN = Pebble Intermediate CA 1a2b3c\n' +
+            'X509v3 Subject Alternative Name:\n    DNS:deathstar.iamtheinternet.org\n',
+        };
+      }
+      if (cmd.includes('%{http_code}')) return { stdout: '200' };
+      return { stdout: 'Caddy reverse proxy is running' };
+    });
+    const t = createObserverTransport(handle);
+    const r = await t.httpsRequest({ from: 'publicInternet', url: 'https://deathstar.iamtheinternet.org' });
+    expect(r.status).toBe(200);
+    expect(r.cert.cn).toBe('deathstar.iamtheinternet.org');
+    expect(r.cert.issuer).toContain('Pebble');
+    expect(r.cert.subjectAltNames).toContain('deathstar.iamtheinternet.org');
+    expect(r.cert.selfSigned).toBe(false);
+  });
+
+  test('httpsRequest flags a self-signed cert (subject == issuer)', async () => {
+    const { handle } = fakeHandle((_c, cmd) =>
+      cmd.includes('openssl s_client')
+        ? { stdout: 'subject=CN = sketchy.local\nissuer=CN = sketchy.local\n' }
+        : cmd.includes('%{http_code}')
+          ? { stdout: '200' }
+          : {},
+    );
+    const t = createObserverTransport(handle);
+    const r = await t.httpsRequest({ from: 'internalDevice', url: 'https://sketchy.local' });
+    expect(r.cert.selfSigned).toBe(true);
+  });
+});
+
+describe('host-shell footgun guard', () => {
+  test('no command contains $(...) or backticks (would be host-evaluated through the wrap)', async () => {
+    const { handle, calls } = fakeHandle(() => ({ stdout: '200', exitCode: 0 }));
+    const t = createObserverTransport(handle);
+    await t.resolve({ from: 'internalDevice', name: 'www.x', method: 'system' });
+    await t.resolve({ from: 'internalDevice', name: 'www.x', method: 'dns', server: '192.168.0.10' });
+    await t.resolve({ from: 'internalDevice', name: 'www.x', method: 'hostfiles' });
+    await t.tcpConnect({ from: 'internalDevice', host: '10.0.10.10', port: 443 });
+    await t.ping({ from: 'internalDevice', target: '192.168.0.253' });
+    await t.httpsRequest({ from: 'internalDevice', url: 'https://www.x' });
+    await t.inspectResolution({ from: 'internalDevice', name: 'www.x' });
+    expect(calls.length).toBeGreaterThan(0);
+    for (const { cmd } of calls) {
+      expect(cmd).not.toContain('$(');
+      expect(cmd).not.toContain('`');
+    }
+  });
+});