@celilo/e2e 0.8.0 → 0.9.0

package/src/docker-compose-generator.ts

@@ -18,9 +18,11 @@ import { ZONE_GATEWAYS } from './types';
  * - **npm-installed consumer** (lunacycle and friends) — `../../modules`
  *   would resolve to `<consumer>/node_modules/modules`, which doesn't
  *   exist. Docker fails the mount with "permission denied" trying to
- *   create that path. Instead we bind the pre-shipped `./netapps/` dir
- *   (always present in the npm tarball) to `/uploads`, and the registry's
- *   scanUploadsDir picks up the .netapp files.
+ *   create that path. Instead we bind the local `./netapps/` dir to
+ *   `/uploads`, and the registry's scanUploadsDir picks up the .netapp
+ *   files. That dir is populated at `cele2e build-infra` time by fetching
+ *   the standard-module netapps from the public registry (see
+ *   stageNetappsFromRegistry in cli/build.ts) — consumers vendor nothing.
  *
  * Detection: check whether the would-be monorepo modules dir is real.
  * `import.meta.dir` is `<pkgDir>/src/`, so `../../../modules` from there

package/src/network-builder.ts

@@ -2,7 +2,7 @@ import { execSync } from 'node:child_process';
 import { existsSync } from 'node:fs';
 import { join } from 'node:path';
 import { startNetwork } from './container-manager';
-import type { NetworkConfig, NetworkHandle, TopologyPreset, Vantage } from './types';
+import type { MachineSpec, NetworkConfig, NetworkHandle, TopologyPreset, Vantage, Zone } from './types';
 
 /**
  * If a mounted path looks like a celilo module (has scripts/package.json),
@@ -51,53 +51,45 @@ export class NetworkBuilder {
     return this;
   }
 
-  dmz(machines: Record<string, string>): this {
+  /** Append `{name, ip, zone, ...extra}` for each entry to a zone's machine list. */
+  private addMachines(
+    target: MachineSpec[],
+    zone: Zone,
+    machines: Record<string, string>,
+    extra?: Pick<MachineSpec, 'docker' | 'dockerfile'>,
+  ): this {
     for (const [name, ip] of Object.entries(machines)) {
-      this.config.dmzMachines.push({ name, ip, zone: 'dmz' });
+      target.push({ name, ip, zone, ...extra });
     }
     return this;
   }
 
+  dmz(machines: Record<string, string>): this {
+    return this.addMachines(this.config.dmzMachines, 'dmz', machines);
+  }
+
   app(machines: Record<string, string>): this {
-    for (const [name, ip] of Object.entries(machines)) {
-      this.config.appMachines.push({ name, ip, zone: 'app' });
-    }
-    return this;
+    return this.addMachines(this.config.appMachines, 'app', machines);
   }
 
   secure(machines: Record<string, string>): this {
-    for (const [name, ip] of Object.entries(machines)) {
-      this.config.secureMachines.push({ name, ip, zone: 'secure' });
-    }
-    return this;
+    return this.addMachines(this.config.secureMachines, 'secure', machines);
   }
 
   internal(machines: Record<string, string>): this {
-    for (const [name, ip] of Object.entries(machines)) {
-      this.config.internalMachines.push({ name, ip, zone: 'internal' });
-    }
-    return this;
+    return this.addMachines(this.config.internalMachines, 'internal', machines);
   }
 
   /** Add internal-zone machines that need the Docker-capable image (e.g., Technitium) */
   internalDocker(machines: Record<string, string>): this {
-    for (const [name, ip] of Object.entries(machines)) {
-      this.config.internalMachines.push({ name, ip, zone: 'internal', docker: true });
-    }
-    return this;
+    return this.addMachines(this.config.internalMachines, 'internal', machines, { docker: true });
   }
 
   /** Add a Technitium DNS machine using the dedicated pre-installed image */
   technitium(machines: Record<string, string>): this {
-    for (const [name, ip] of Object.entries(machines)) {
-      this.config.internalMachines.push({
-        name,
-        ip,
-        zone: 'internal',
-        dockerfile: 'docker/Dockerfile.target-technitium',
-      });
-    }
-    return this;
+    return this.addMachines(this.config.internalMachines, 'internal', machines, {
+      dockerfile: 'docker/Dockerfile.target-technitium',
+    });
   }
 
   withDhcpClient(): this {

package/src/runner.ts

@@ -31,6 +31,7 @@ import {
 } from './bus-events';
 import { parseLine } from './parse-line';
 import { acquireRunLock, E2eBusyError, markKept } from './run-lock';
+import { SIMULATOR_IPS } from './simulator-ips';
 
 // ─── Config ──────────────────────────────────────────────────────────
 
@@ -91,6 +92,32 @@ const flagCiSafe = rawArgs.includes('--ci-safe');
 // --notify: fire a desktop notification when the run finishes (handy for long
 // detached/background runs). Best-effort — never affects the exit code.
 const flagNotify = rawArgs.includes('--notify');
+// --shuffle [--seed=N]: randomize test order to surface order-dependent bugs
+// (e2e-confidence #258). The install-sh DNS-pollution bug only manifested in a
+// specific order — a shuffle lane flushes that class out. Seeded + logged so a
+// failing order is reproducible: replay with the printed --seed=N.
+const flagShuffle = rawArgs.includes('--shuffle');
+const seedFlag = rawArgs.find((a) => a.startsWith('--seed='));
+const seedArg = seedFlag ? Number.parseInt(seedFlag.split('=')[1] ?? '', 10) : undefined;
+
+/** Deterministic Fisher-Yates shuffle seeded by a 32-bit value (mulberry32), so
+ * a randomized test order is reproducible via --seed=<n>. */
+function seededShuffle<T>(arr: readonly T[], seed: number): T[] {
+  let s = seed >>> 0;
+  const rand = (): number => {
+    s = (s + 0x6d2b79f5) >>> 0;
+    let t = s;
+    t = Math.imul(t ^ (t >>> 15), t | 1);
+    t ^= t + Math.imul(t ^ (t >>> 7), t | 61);
+    return ((t ^ (t >>> 14)) >>> 0) / 4294967296;
+  };
+  const out = [...arr];
+  for (let i = out.length - 1; i > 0; i--) {
+    const j = Math.floor(rand() * (i + 1));
+    [out[i], out[j]] = [out[j], out[i]];
+  }
+  return out;
+}
 
 function notify(title: string, message: string): void {
   if (!flagNotify) return;
@@ -411,6 +438,31 @@ function stopSharedInfra(): void {
   try { execSync('docker network prune -f', { stdio: 'pipe', timeout: 10_000 }); } catch {}
 }
 
+/**
+ * Detect cross-test pollution of the SHARED authoritative DNS at the test
+ * boundary (e2e-confidence #254). A test that leaves a protected sim record
+ * clobbered — canonically celilo.computer's apex off the website-sim, the bug
+ * that silently broke install-sh ~15 tests downstream — has violated the shared
+ * contract. Checked AFTER each test so the polluter is named HERE, at the cause,
+ * instead of a later test failing mysteriously. On detection we re-scrub
+ * (cp /seed -> /config, mirroring scrubDnsZones) so the damage doesn't cascade.
+ *
+ * Returns a description of the violation (and heals) if polluted, else null.
+ * A query failure (infra down / tool missing) is not treated as pollution.
+ */
+function detectSharedDnsPollution(): string | null {
+  const served = dockerComposeShared(
+    `exec -T namecheap-dns sh -c ${JSON.stringify('kdig @127.0.0.1 celilo.computer A +short')}`,
+  ).trim();
+  if (!served) return null;
+  if (served.split(/\s+/).includes(SIMULATOR_IPS.WEBSITE)) return null;
+  // Polluted — heal so the next test starts from a clean baseline.
+  dockerComposeShared(
+    `exec -T namecheap-dns sh -c ${JSON.stringify('cp -f /seed/*.zone /config/ && knotc zone-reload')}`,
+  );
+  return `celilo.computer apex resolves to "${served}" (expected the website-sim ${SIMULATOR_IPS.WEBSITE})`;
+}
+
 // ─── Docker Check ────────────────────────────────────────────────────
 
 function assertDockerAvailable(): void {
@@ -545,6 +597,17 @@ async function main() {
     process.exit(1);
   }
 
+  // e2e-confidence #258: optionally randomize order to surface order-dependent
+  // bugs (the install-sh DNS bleed only manifested in a specific order). Seeded
+  // + logged so a failing order replays exactly via --seed=<n>.
+  if (flagShuffle) {
+    const seed = (seedArg !== undefined && Number.isFinite(seedArg) ? seedArg : Date.now()) >>> 0;
+    testFiles = seededShuffle(testFiles, seed);
+    console.log(
+      `${dim}--shuffle: randomized test order (seed=${seed}) — replay this exact order with --seed=${seed}${reset}`,
+    );
+  }
+
   // --keep keeps a single test network alive after the run; only one network
   // can live in `.e2e-persistent.json` at a time, so multiple tests would
   // either fight for that slot or run with no functional --keep at all. Bail
@@ -664,6 +727,17 @@ async function main() {
 
     emitTestStarted({ runId, name, expectedDurationS: expected });
     const result = await runTest(file, name, expected, logDir, display);
+
+    // e2e-confidence #254: name a test that leaves shared infra polluted, at the
+    // boundary — before a later test fails mysteriously downstream. detect…()
+    // also heals (re-scrubs), so a passing-but-polluting test is failed here AND
+    // the next test still starts clean.
+    const pollution = detectSharedDnsPollution();
+    if (pollution && result.status === 'pass') {
+      result.status = 'fail';
+      result.error = `cross-test pollution (#254): this test left shared DNS dirty — ${pollution}`;
+    }
+
     emitTestCompleted({
       runId,
       name,

package/src/shared-infra.ts

@@ -28,8 +28,6 @@ function run(cmd: string, opts?: { cwd?: string; timeout?: number }): string {
   }).trim();
 }
 
-let sharedInfraRunning = false;
-
 /**
  * Remove ALL celilo-e2e-* Docker resources by name prefix (#212). Used at
  * start-of-run, where the run-lock guarantees no other session's stack is live.
@@ -74,10 +72,8 @@ function nukeE2eResources(e2eDir: string): void {
  *     per-test stack failed with "network … declared as external,
  *     but could not be found" when starting per-test services).
  *
- * Source of truth is Docker, never the module-local
- * `sharedInfraRunning` flag in isolation — each test file runs in a
- * fresh bun process so that flag is always `false` at startup. The
- * flag exists only as a within-process cache for redundant calls.
+ * Source of truth is always Docker — each test file runs in a fresh
+ * bun process, so there is no reliable in-process cache to lean on.
  */
 export function isSharedInfraRunning(): boolean {
   try {
@@ -86,20 +82,16 @@ export function isSharedInfraRunning(): boolean {
       { cwd: getE2eDir() },
     );
     if (containers.trim().length === 0) {
-      sharedInfraRunning = false;
       return false;
     }
     const networks = run('docker network ls --format "{{.Name}}"');
     const networkLines = networks.split('\n');
     const haveAll = Object.values(SHARED_NETWORKS).every((n) => networkLines.includes(n));
     if (!haveAll) {
-      sharedInfraRunning = false;
       return false;
     }
-    sharedInfraRunning = true;
     return true;
   } catch {
-    sharedInfraRunning = false;
     return false;
   }
 }
@@ -192,7 +184,6 @@ export async function ensureSharedInfra(): Promise<void> {
         { cwd: e2eDir, timeout: 10_000 },
       );
       if (result.trim().length > 0) {
-        sharedInfraRunning = true;
         console.log('[progress:done] shared infrastructure ready');
         return;
       }
@@ -241,21 +232,4 @@ export async function stopSharedInfra(): Promise<void> {
   } catch {
     // Best effort
   }
-  sharedInfraRunning = false;
-}
-
-/**
- * Execute a command in a shared infrastructure container.
- */
-export function sharedExec(container: string, cmd: string, timeoutMs = 60_000): { stdout: string; exitCode: number } {
-  try {
-    const stdout = run(
-      `docker compose -f ${SHARED_COMPOSE_FILE} -p ${SHARED_PROJECT_NAME} exec -T ${container} bash -c ${JSON.stringify(cmd)}`,
-      { cwd: getE2eDir(), timeout: timeoutMs },
-    );
-    return { stdout, exitCode: 0 };
-  } catch (err: unknown) {
-    const e = err as { stdout?: string; status?: number };
-    return { stdout: e.stdout?.toString() ?? '', exitCode: e.status ?? 1 };
-  }
 }

package/src/types.ts

@@ -193,11 +193,17 @@ export interface NetworkHandle {
   /** Resolve a DNS name from the management machine */
   dig(name: string): Promise<string>;
 
-  /** Wait for a condition with timeout */
+  /**
+   * Wait for a condition with timeout. On timeout, `onTimeout` (if given) is
+   * invoked to collect live-state diagnostics that are appended to the error —
+   * so a readiness failure self-diagnoses instead of speculating
+   * (e2e-confidence #255).
+   */
   waitFor(
     check: () => Promise<boolean>,
     timeoutMs: number,
     label: string,
+    onTimeout?: () => string | Promise<string>,
   ): Promise<void>;
 
   /**
@@ -342,6 +348,15 @@ export interface ResponderValues {
       secretValues?: Record<string, string>;
     }
   >;
+  /**
+   * Aspect-consent decisions (ISS-0027 / #262). When a headless deploy emits
+   * `aspect.required.<module>.<role>`, the responder replies `{ consented }`
+   * so a module's base_module_aspect fan-out is approved without a TTY and
+   * without `--accept-aspects` at import. Lookup precedence: `<module>.<role>`,
+   * then `<module>`, then the `'*'` wildcard. Absent → skipped (never
+   * silently approved). Passed straight through to `celilo events respond`.
+   */
+  aspects?: Record<string, boolean>;
 }
 
 export const ZONE_GATEWAYS: Record<Zone, string> = {

package/config/dns/example.net.zone

@@ -1,16 +0,0 @@
-$ORIGIN example.net.
-$TTL 300
-
-@ IN SOA ns1.example.net. admin.example.net. (
-    2024020108 300 60 604800 300
-)
-
-; Public DNS — RFC 1918 addresses NEVER appear here. The whole point of
-; the e2e simulation is to model real internet connectivity, where
-; private IPs are unreachable from outside. All public-facing names
-; resolve to the firewall's external IP (100.100.0.100), which DNATs
-; inbound to the right internal host.
-@       IN NS   ns1.example.net.
-ns1     IN A    100.64.0.55
-@       IN A    100.100.0.100
-www     IN A    100.100.0.100

package/config/dns/iamtheinternet.org.zone

@@ -1,16 +0,0 @@
-$ORIGIN iamtheinternet.org.
-$TTL 300
-
-@ IN SOA ns1.iamtheinternet.org. admin.iamtheinternet.org. (
-    2024020247 300 60 604800 300
-)
-
-; Public DNS — RFC 1918 addresses NEVER appear here. The whole point of
-; the e2e simulation is to model real internet connectivity, where
-; private IPs are unreachable from outside. All public-facing names
-; resolve to the firewall's external IP (100.100.0.100), which DNATs
-; inbound to the right internal host.
-@       IN NS   ns1.iamtheinternet.org.
-ns1     IN A    100.64.0.55
-@       IN A    0.0.0.0
-www     IN A    100.100.0.100