@celilo/e2e 0.9.2 → 0.10.0

package/src/runner.ts

@@ -17,11 +17,11 @@
  *   Countdown goes negative when over estimate.
  */
 
-import { spawn, spawnSync, execSync } from 'node:child_process';
+import { execSync, spawn, spawnSync } from 'node:child_process';
 import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from 'node:fs';
 import { basename, dirname, join, resolve } from 'node:path';
-import { parse as parseYaml } from 'yaml';
 import { type DisplayMode, ProgressDisplay } from '@celilo/cli-display';
+import { parse as parseYaml } from 'yaml';
 import {
   emitRunCompleted,
   emitRunFailed,
@@ -30,7 +30,7 @@ import {
   emitTestStarted,
 } from './bus-events';
 import { parseLine } from './parse-line';
-import { acquireRunLock, E2eBusyError, markKept } from './run-lock';
+import { E2eBusyError, acquireRunLock, markKept } from './run-lock';
 import { SIMULATOR_IPS } from './simulator-ips';
 
 // ─── Config ──────────────────────────────────────────────────────────
@@ -50,7 +50,9 @@ function resolveModuleTestsDir(dir: string): string {
   const manifestPath = join(dir, 'manifest.yml');
   if (existsSync(manifestPath)) {
     try {
-      const parsed = parseYaml(readFileSync(manifestPath, 'utf-8')) as { e2e?: { tests_dir?: string } };
+      const parsed = parseYaml(readFileSync(manifestPath, 'utf-8')) as {
+        e2e?: { tests_dir?: string };
+      };
       if (parsed?.e2e?.tests_dir) return resolve(dir, parsed.e2e.tests_dir);
     } catch {}
   }
@@ -84,11 +86,14 @@ const flagCi = rawArgs.includes('--ci');
 const flagNoCi = rawArgs.includes('--no-ci');
 const ci = flagCi || (!flagNoCi && !!process.env.CI);
 const patterns = rawArgs.filter((a) => !a.startsWith('--'));
-// --ci-safe: skip tests marked `cele2e-ci-unsafe` in their file (quarantined —
-// known-failing or builder-flaky, each tracked by an ISS). `--complete`/`--all`
-// run everything. Passed through from the CLI (not stripped) so the runner can
-// apply the exclusion.
-const flagCiSafe = rawArgs.includes('--ci-safe');
+// Quarantine: tests whose file contains the marker `cele2e-ci-unsafe` (a comment
+// naming the reason + ISS) are known-failing / builder-flaky and tracked
+// separately, so they must never turn a broad run red. They are SKIPPED by
+// default in every broad run (`--all`, `--all-modules`, `--ci-safe`, bare). Two
+// ways to run one anyway: name it explicitly (`cele2e run <name>`), or pass
+// `--complete` (the deliberate "run everything, including quarantined" opt-in).
+// `--complete` is passed through from the CLI (not stripped) so the runner sees it.
+const flagComplete = rawArgs.includes('--complete');
 // --notify: fire a desktop notification when the run finishes (handy for long
 // detached/background runs). Best-effort — never affects the exit code.
 const flagNotify = rawArgs.includes('--notify');
@@ -123,9 +128,20 @@ function notify(title: string, message: string): void {
   if (!flagNotify) return;
   try {
     if (process.platform === 'darwin') {
-      const r = spawnSync('terminal-notifier', ['-title', title, '-message', message, '-sound', 'Glass'], { stdio: 'ignore' });
+      const r = spawnSync(
+        'terminal-notifier',
+        ['-title', title, '-message', message, '-sound', 'Glass'],
+        { stdio: 'ignore' },
+      );
       if (r.error) {
-        spawnSync('osascript', ['-e', `display notification ${JSON.stringify(message)} with title ${JSON.stringify(title)} sound name "Glass"`], { stdio: 'ignore' });
+        spawnSync(
+          'osascript',
+          [
+            '-e',
+            `display notification ${JSON.stringify(message)} with title ${JSON.stringify(title)} sound name "Glass"`,
+          ],
+          { stdio: 'ignore' },
+        );
       }
       spawnSync('say', [message], { stdio: 'ignore' });
     } else if (process.platform === 'linux') {
@@ -182,7 +198,10 @@ function extractFailureMessage(lines: string[], exitCode: number): string {
   // bun's own test failure: "✗ test name [Xms]" — extract the failing test name
   const bunFailIdx = plain.findIndex((l) => /^\s*✗\s+\S/.test(l) && !l.includes('failed ('));
   if (bunFailIdx >= 0) {
-    const testName = plain[bunFailIdx].replace(/^\s*✗\s+/, '').replace(/\s*\[\d+ms\].*$/, '').trim();
+    const testName = plain[bunFailIdx]
+      .replace(/^\s*✗\s+/, '')
+      .replace(/\s*\[\d+ms\].*$/, '')
+      .trim();
     // Grab the error detail on the next few lines (bun indents it under the test)
     const detail = plain
       .slice(bunFailIdx + 1, bunFailIdx + 6)
@@ -215,7 +234,13 @@ function extractFailureMessage(lines: string[], exitCode: number): string {
 
   // Last resort: print the last few non-empty, non-progress lines from the output
   const tail = plain
-    .filter((l) => l.length > 0 && !l.startsWith('[progress') && !l.startsWith('[e2e:') && !l.startsWith('[ansible:'))
+    .filter(
+      (l) =>
+        l.length > 0 &&
+        !l.startsWith('[progress') &&
+        !l.startsWith('[e2e:') &&
+        !l.startsWith('[ansible:'),
+    )
     .slice(-3)
     .map((l) => l.trim())
     .join(' | ');
@@ -270,7 +295,9 @@ async function runTest(
         testEnv.CELILO_E2E_REUSE = '1';
         testEnv.CELILO_E2E_PROJECT = data.projectName;
       } catch {
-        console.error(`${red}✗ --reuse: no persistent network found. Run with --keep first.${reset}`);
+        console.error(
+          `${red}✗ --reuse: no persistent network found. Run with --keep first.${reset}`,
+        );
         process.exit(1);
       }
     }
@@ -298,23 +325,32 @@ async function runTest(
       process.stdout.write(`${bold}\x1b[33m║${reset}  Container: ${bold}${container}${reset}\n`);
       process.stdout.write(`${bold}\x1b[33m║${reset}\n`);
       process.stdout.write(`${bold}\x1b[33m║${reset}  ${dim}Run commands:${reset}\n`);
-      process.stdout.write(`${bold}\x1b[33m║${reset}    docker compose -f docker-compose.test.yml \\\n`);
-      process.stdout.write(`${bold}\x1b[33m║${reset}      -p ${project} exec ${container} bash -c '<cmd>'\n`);
+      process.stdout.write(
+        `${bold}\x1b[33m║${reset}    docker compose -f docker-compose.test.yml \\\n`,
+      );
+      process.stdout.write(
+        `${bold}\x1b[33m║${reset}      -p ${project} exec ${container} bash -c '<cmd>'\n`,
+      );
       process.stdout.write(`${bold}\x1b[33m║${reset}\n`);
 
       if (interactive) {
-        process.stdout.write(`${bold}\x1b[33m║${reset}  ${dim}Or get a shell: type 'exit' to resume the test.${reset}\n`);
+        process.stdout.write(
+          `${bold}\x1b[33m║${reset}  ${dim}Or get a shell: type 'exit' to resume the test.${reset}\n`,
+        );
         process.stdout.write(`${bold}\x1b[33m╚${border}${reset}\n\n`);
 
-        spawnSync('docker', [
-          'compose', '-f', 'docker-compose.test.yml', '-p', project,
-          'exec', container, 'bash',
-        ], {
-          cwd: PKG_DIR,
-          stdio: 'inherit',
-        });
+        spawnSync(
+          'docker',
+          ['compose', '-f', 'docker-compose.test.yml', '-p', project, 'exec', container, 'bash'],
+          {
+            cwd: PKG_DIR,
+            stdio: 'inherit',
+          },
+        );
       } else {
-        process.stdout.write(`${bold}\x1b[33m║${reset}  ${dim}Resume: touch ${signalFile}${reset}\n`);
+        process.stdout.write(
+          `${bold}\x1b[33m║${reset}  ${dim}Resume: touch ${signalFile}${reset}\n`,
+        );
         process.stdout.write(`${bold}\x1b[33m╚${border}${reset}\n\n`);
 
         // Non-interactive: just wait for the signal file (no shell)
@@ -376,7 +412,7 @@ async function runTest(
       writeFileSync(logFile, stdout + '\n---STDERR---\n' + stderr);
 
       const expectMatch = stdout.match(/(\d+) expect\(\) calls/);
-      const expectCount = expectMatch ? parseInt(expectMatch[1], 10) : undefined;
+      const expectCount = expectMatch ? Number.parseInt(expectMatch[1], 10) : undefined;
 
       if (code === 0) {
         if (expectCount === 0) {
@@ -389,7 +425,13 @@ async function runTest(
             error: '0 assertions — test likely exited before reaching assertions',
           });
         } else {
-          resolveTest({ name, status: 'pass', duration, hadDebugPause, projectName: capturedProjectName });
+          resolveTest({
+            name,
+            status: 'pass',
+            duration,
+            hadDebugPause,
+            projectName: capturedProjectName,
+          });
         }
       } else {
         // Collect a raw tail: strip ANSI, drop internal protocol lines, keep last 30
@@ -397,12 +439,13 @@ async function runTest(
           .split('\n')
           .map(stripAnsi)
           .map((l) => l.trimEnd())
-          .filter((l) =>
-            l.length > 0 &&
-            !l.startsWith('[progress') &&
-            !l.startsWith('[e2e:') &&
-            !l.startsWith('[ansible:') &&
-            !l.startsWith('[debug:'),
+          .filter(
+            (l) =>
+              l.length > 0 &&
+              !l.startsWith('[progress') &&
+              !l.startsWith('[e2e:') &&
+              !l.startsWith('[ansible:') &&
+              !l.startsWith('[debug:'),
           )
           .slice(-30)
           .join('\n');
@@ -424,10 +467,12 @@ async function runTest(
 
 function dockerComposeShared(cmd: string): string {
   try {
-    return execSync(
-      `docker compose -f docker-compose.shared.yml -p celilo-e2e-shared ${cmd}`,
-      { cwd: PKG_DIR, encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'], timeout: 60_000 },
-    ).trim();
+    return execSync(`docker compose -f docker-compose.shared.yml -p celilo-e2e-shared ${cmd}`, {
+      cwd: PKG_DIR,
+      encoding: 'utf-8',
+      stdio: ['pipe', 'pipe', 'pipe'],
+      timeout: 60_000,
+    }).trim();
   } catch {
     return '';
   }
@@ -435,7 +480,9 @@ function dockerComposeShared(cmd: string): string {
 
 function stopSharedInfra(): void {
   dockerComposeShared('down --volumes --remove-orphans');
-  try { execSync('docker network prune -f', { stdio: 'pipe', timeout: 10_000 }); } catch {}
+  try {
+    execSync('docker network prune -f', { stdio: 'pipe', timeout: 10_000 });
+  } catch {}
 }
 
 /**
@@ -486,14 +533,20 @@ async function main() {
   // docker mutation so a competing run can't wipe our shared infra mid-setup.
   const lockLabel = patterns.length ? patterns.join(',') : moduleDirs.length ? 'modules' : 'all';
   try {
-    acquireRunLock({ test: lockLabel, runId: process.env.CELE2E_RUN_ID ?? ambientRunId, allowKept: flagReuse });
+    acquireRunLock({
+      test: lockLabel,
+      runId: process.env.CELE2E_RUN_ID ?? ambientRunId,
+      allowKept: flagReuse,
+    });
     // A --reuse run keeps using a kept stack that stays up afterwards — hold the
     // lock in kept state so it isn't freed out from under the reused network.
     if (flagReuse) markKept();
   } catch (err) {
     if (err instanceof E2eBusyError) {
       console.error(`\n${red}${err.message}${reset}`);
-      console.error(`${dim}Poll with: cele2e status   (machine-readable: cele2e status --json)${reset}\n`);
+      console.error(
+        `${dim}Poll with: cele2e status   (machine-readable: cele2e status --json)${reset}\n`,
+      );
       process.exit(3);
     }
     throw err;
@@ -511,7 +564,9 @@ async function main() {
       const tp = resolveModuleTestsDir(dir);
       if (!existsSync(tp)) {
         console.error(`${red}No tests directory found at ${tp}${reset}`);
-        console.error(`${red}Set e2e.tests_dir in ${join(dir, 'manifest.yml')} to point to your test files.${reset}`);
+        console.error(
+          `${red}Set e2e.tests_dir in ${join(dir, 'manifest.yml')} to point to your test files.${reset}`,
+        );
         process.exit(1);
       }
       // Auto-install e2e/ dependencies if package.json exists but node_modules is missing
@@ -573,11 +628,10 @@ async function main() {
     testFiles = testFiles.filter((f) => patterns.some((p) => basename(f, '.test.ts').includes(p)));
   }
 
-  // --ci-safe: drop quarantined tests — those whose file contains the marker
-  // `cele2e-ci-unsafe` (a comment naming the reason + ISS). Keeps the nightly
-  // green on the CI-safe subset while the quarantined tests are tracked + fixed
-  // separately. `--complete`/`--all` run everything (no exclusion).
-  if (flagCiSafe) {
+  // Drop quarantined tests (file contains `cele2e-ci-unsafe`) from broad runs so
+  // they never turn a full run red. Skipped by default; bypassed only when the
+  // user explicitly named tests (`patterns.length > 0`) or passed `--complete`.
+  if (!flagComplete && patterns.length === 0) {
     const before = testFiles.length;
     testFiles = testFiles.filter((f) => {
       try {
@@ -588,7 +642,9 @@ async function main() {
     });
     const skipped = before - testFiles.length;
     if (skipped > 0) {
-      console.log(`${dim}--ci-safe: skipped ${skipped} quarantined (cele2e-ci-unsafe) test(s)${reset}`);
+      console.log(
+        `${dim}skipped ${skipped} quarantined (cele2e-ci-unsafe) test(s) — pass --complete or name one to run it${reset}`,
+      );
     }
   }
 
@@ -637,7 +693,9 @@ async function main() {
   console.log(`${bold}╔══════════════════════════════════════════════════════════════${reset}`);
   console.log(`${bold}║  Celilo E2E Tests${moduleLabel}${reset}`);
   if (hasHistory) {
-    console.log(`${bold}║  ${testFiles.length} test(s) — expected ~${formatDuration(suiteExpected)}${reset}`);
+    console.log(
+      `${bold}║  ${testFiles.length} test(s) — expected ~${formatDuration(suiteExpected)}${reset}`,
+    );
   } else {
     console.log(`${bold}║  ${testFiles.length} test(s) — first run, no timing history${reset}`);
   }
@@ -741,7 +799,8 @@ async function main() {
     emitTestCompleted({
       runId,
       name,
-      status: result.status === 'pass' ? 'pass' : result.status === 'suspicious' ? 'suspicious' : 'fail',
+      status:
+        result.status === 'pass' ? 'pass' : result.status === 'suspicious' ? 'suspicious' : 'fail',
       durationMs: result.duration * 1000,
       error: result.error,
       logDir,
@@ -757,11 +816,15 @@ async function main() {
     if (flagKeep && result.projectName) {
       writeFileSync(
         persistentFile,
-        JSON.stringify({
-          projectName: result.projectName,
-          testFile: file,
-          createdAt: new Date().toISOString(),
-        }, null, 2) + '\n',
+        JSON.stringify(
+          {
+            projectName: result.projectName,
+            testFile: file,
+            createdAt: new Date().toISOString(),
+          },
+          null,
+          2,
+        ) + '\n',
       );
       console.log(`${dim}  Persistent network: ${result.projectName}${reset}`);
       console.log(`${dim}  Reuse: ${basename(process.argv[1])} --reuse${reset}`);
@@ -800,7 +863,9 @@ async function main() {
       JSON.stringify({ status: result.status, duration: result.duration, error: result.error }),
     );
 
-    try { execSync('docker network prune -f', { stdio: 'pipe', timeout: 10_000 }); } catch {}
+    try {
+      execSync('docker network prune -f', { stdio: 'pipe', timeout: 10_000 });
+    } catch {}
   }
 
   saveTiming(history);
@@ -820,7 +885,9 @@ async function main() {
   for (const r of results) {
     const icon = r.status === 'pass' ? '✓' : '✗';
     const color = r.status === 'pass' ? green : red;
-    console.log(`${bold}║${reset}  ${color}${icon}${reset} ${r.name.padEnd(28)} ${dim}${(r.duration + 's').padStart(6)}${reset}`);
+    console.log(
+      `${bold}║${reset}  ${color}${icon}${reset} ${r.name.padEnd(28)} ${dim}${(r.duration + 's').padStart(6)}${reset}`,
+    );
     if (r.error) {
       console.log(`${bold}║${reset}    ${red}└─ ${r.error}${reset}`);
     }
@@ -832,7 +899,11 @@ async function main() {
 
   writeFileSync(
     join(resultsDir, 'summary.json'),
-    JSON.stringify({ timestamp, total: testFiles.length, passed, failed, duration: suiteDuration }, null, 2),
+    JSON.stringify(
+      { timestamp, total: testFiles.length, passed, failed, duration: suiteDuration },
+      null,
+      2,
+    ),
   );
 
   const gitignore = join(testDir, '.gitignore');

package/src/simulator-ips.ts

@@ -35,6 +35,15 @@ export const SIMULATOR_IPS = {
   APT_REPO: '100.64.0.60',
   /** MinIO S3-compatible object storage — backup/restore target (replaces AWS S3 in tests). Reachable at http://minio.lab. */
   MINIO: '100.64.0.61',
+  /**
+   * OFF-FLEET cPanel/SSH web host simulator (`tangohost.com`) — a third-party
+   * host celilo publishes to via `external_web` but does NOT govern. A public
+   * peer of namecheap-dns/pebble, NOT behind the customer firewall, so public
+   * DNS pointing the domain here is a genuine public endpoint.
+   */
+  CPANEL_HOST: '100.64.0.63',
+  /** signal-cli release host — serves the tarball the signal module downloads at deploy time. */
+  SIGNAL_RELEASE: '100.64.0.62',
   /** Pebble ACME server (replaces production Let's Encrypt). */
   PEBBLE: '100.64.0.100',
 } as const;

package/src/types.ts

@@ -45,6 +45,40 @@ export interface NetworkConfig {
   managementVolumes: string[];
   /** Include a DHCP client container on the internal network */
   dhcpClient: boolean;
+  /**
+   * Include a REAL signal-cli daemon on the internal network.
+   *
+   * Never linked to a Signal account — the JSON-RPC interface is served
+   * locally and needs none. It exists so the contract celilo's client depends
+   * on is verified against the actual binary rather than against a simulator
+   * that encodes the same assumptions. See design.md D16.
+   */
+  signalCli: boolean;
+  /**
+   * Include the signal-cli SIMULATOR on the internal network.
+   *
+   * The drivable counterpart to `signalCli`: it can queue an inbound reply,
+   * fail a recipient inside a JSON-RPC success, and revoke the device link on
+   * command, which is what a test of the delivery/ack loop needs and what an
+   * unlinked real daemon cannot be made to do.
+   */
+  signalSim: boolean;
+  /**
+   * Serve the signal-cli release tarball from the simulated internet, so the
+   * signal module's deploy-time download resolves inside the sealed network.
+   */
+  signalRelease: boolean;
+  /**
+   * Which zone the celilo management container sits in. Defaults to `internal`
+   * — the single-network topology every existing test uses.
+   *
+   * `secure-mgmt` places celilo-mgr on its OWN control-plane network, which is
+   * the production topology and the one the suite could not express before. That
+   * gap is why the control-plane-network bug reached production: with management
+   * always on `internal`, the hardcoded "trusted subnet == network.internal.subnet"
+   * assumption was accidentally true in every test.
+   */
+  managementZone?: 'internal' | 'secure-mgmt';
   /**
    * Observer vantages to inject into the topology. Each becomes an `observer-*`
    * container — a passive spy carrying the probe tooling, placed at the named

package/config/dns/example.net.zone

@@ -1,16 +0,0 @@
-$ORIGIN example.net.
-$TTL 300
-
-@ IN SOA ns1.example.net. admin.example.net. (
-    2024020108 300 60 604800 300
-)
-
-; Public DNS — RFC 1918 addresses NEVER appear here. The whole point of
-; the e2e simulation is to model real internet connectivity, where
-; private IPs are unreachable from outside. All public-facing names
-; resolve to the firewall's external IP (100.100.0.100), which DNATs
-; inbound to the right internal host.
-@       IN NS   ns1.example.net.
-ns1     IN A    100.64.0.55
-@       IN A    100.100.0.100
-www     IN A    100.100.0.100

package/config/dns/iamtheinternet.org.zone

@@ -1,16 +0,0 @@
-$ORIGIN iamtheinternet.org.
-$TTL 300
-
-@ IN SOA ns1.iamtheinternet.org. admin.iamtheinternet.org. (
-    2024020247 300 60 604800 300
-)
-
-; Public DNS — RFC 1918 addresses NEVER appear here. The whole point of
-; the e2e simulation is to model real internet connectivity, where
-; private IPs are unreachable from outside. All public-facing names
-; resolve to the firewall's external IP (100.100.0.100), which DNATs
-; inbound to the right internal host.
-@       IN NS   ns1.iamtheinternet.org.
-ns1     IN A    100.64.0.55
-@       IN A    0.0.0.0
-www     IN A    100.100.0.100