@openparachute/hub 0.5.14-rc.6 → 0.5.14-rc.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openparachute/hub",
-  "version": "0.5.14-rc.6",
+  "version": "0.5.14-rc.8",
   "description": "parachute \u2014 the local hub for the Parachute ecosystem (discovery, ports, lifecycle, soon OAuth).",
   "license": "AGPL-3.0",
   "publishConfig": {

package/src/__tests__/init.test.ts

@@ -2,7 +2,7 @@ import { describe, expect, test } from "bun:test";
 import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { init, resolveAdminUrl } from "../commands/init.ts";
+import { init, looksLikeServer, resolveAdminUrl } from "../commands/init.ts";
 import type { ExposeState } from "../expose-state.ts";
 import { writeHubPort } from "../hub-control.ts";
 import { writePid } from "../process-state.ts";
@@ -24,6 +24,16 @@ function makeHarness(): Harness {
   };
 }
 
+/**
+ * Default test-stub for the vault-module install step (hub#168 Cut 1).
+ * The real `installVaultModuleImpl` shells out to `bun add -g
+ * @openparachute/vault` + seeds services.json — neither is appropriate in
+ * a unit test (slow + side-effectful + leaks state across runs). Tests
+ * that want to observe install-flow side-effects (services.json shape,
+ * etc.) can override this with their own stub.
+ */
+const noopVaultInstall = async (_configDir: string, _manifestPath: string): Promise<number> => 0;
+
 function seedVault(manifestPath: string): void {
   writeFileSync(
     manifestPath,
@@ -88,6 +98,7 @@ describe("init", () => {
         readExposeStateFn: () => undefined,
         isTty: false,
         platform: "linux",
+        installVaultModuleImpl: noopVaultInstall,
       });
       expect(code).toBe(0);
       expect(calls).toEqual(["ensureHub"]);
@@ -124,6 +135,7 @@ describe("init", () => {
         readExposeStateFn: () => undefined,
         isTty: false,
         platform: "linux",
+        installVaultModuleImpl: noopVaultInstall,
       });
       expect(code).toBe(0);
       // Hub was already running — ensureHub should not have been called.
@@ -194,6 +206,12 @@ describe("init", () => {
           opened.push(url);
           return true;
         },
+        // Skip the new exposure prompt — this test is about the browser prompt only.
+        noExposePrompt: true,
+        // Pre-pick the browser wizard so the new (hub#168 Cut 4) "browser
+        // or CLI?" prompt doesn't fire — this test predates that step.
+        wizardChoice: "browser",
+        installVaultModuleImpl: noopVaultInstall,
       });
       expect(code).toBe(0);
       expect(opened).toEqual(["http://127.0.0.1:1939/admin/"]);
@@ -221,6 +239,14 @@ describe("init", () => {
           opened.push(url);
           return true;
         },
+        noExposePrompt: true,
+        // No wizardChoice set — falls into the back-compat Y/n confirm,
+        // where 'n' skips the browser open (the original semantic this
+        // test was written to assert). Suppress the new (hub#168 Cut 4)
+        // wizard-choice prompt so this test stays focused on the Y/n
+        // confirm path.
+        noWizardPrompt: true,
+        installVaultModuleImpl: noopVaultInstall,
       });
       expect(code).toBe(0);
       expect(opened).toEqual([]);
@@ -253,6 +279,7 @@ describe("init", () => {
           return true;
         },
         noBrowser: true,
+        noExposePrompt: true,
       });
       expect(code).toBe(0);
       expect(prompted).toBe(false);
@@ -308,6 +335,7 @@ describe("init", () => {
           opened.push(url);
           return true;
         },
+        noExposePrompt: true,
       });
       expect(code).toBe(0);
       // No prompt offered on Windows — just URL printed.
@@ -332,6 +360,7 @@ describe("init", () => {
         readExposeStateFn: () => undefined,
         isTty: false,
         platform: "linux",
+        installVaultModuleImpl: noopVaultInstall,
       });
       expect(code).toBe(1);
       const joined = logs.join("\n");
@@ -342,3 +371,457 @@ describe("init", () => {
     }
   });
 });
+
+describe("looksLikeServer heuristic", () => {
+  test("macOS is never a server", () => {
+    expect(looksLikeServer("darwin", { SSH_CONNECTION: "1.2.3.4 22 5.6.7.8 22" })).toBe(false);
+    expect(looksLikeServer("darwin", {})).toBe(false);
+  });
+
+  test("Linux desktop with DISPLAY is a laptop", () => {
+    expect(looksLikeServer("linux", { DISPLAY: ":0" })).toBe(false);
+    expect(looksLikeServer("linux", { WAYLAND_DISPLAY: "wayland-0" })).toBe(false);
+  });
+
+  test("Linux + SSH session → server", () => {
+    expect(looksLikeServer("linux", { SSH_CONNECTION: "1.2.3.4 22 5.6.7.8 22" })).toBe(true);
+    expect(looksLikeServer("linux", { SSH_CLIENT: "1.2.3.4 22 5.6.7.8" })).toBe(true);
+    expect(looksLikeServer("linux", { SSH_TTY: "/dev/pts/0" })).toBe(true);
+  });
+
+  test("Linux + no DISPLAY → server (headless)", () => {
+    expect(looksLikeServer("linux", {})).toBe(true);
+  });
+
+  test("Windows is not a server (init doesn't auto-pick on win32 anyway)", () => {
+    expect(looksLikeServer("win32", {})).toBe(false);
+  });
+});
+
+describe("init exposure chain", () => {
+  test("TTY + no exposure + no flags → prompt is shown", async () => {
+    const h = makeHarness();
+    try {
+      writeHubPort(1939, h.configDir);
+      const promptCalls: string[] = [];
+      const code = await init({
+        configDir: h.configDir,
+        manifestPath: h.manifestPath,
+        log: () => {},
+        alive: () => false,
+        ensureHub: async () => ({ pid: 7, port: 1939, started: true }),
+        readExposeStateFn: () => undefined,
+        isTty: true,
+        platform: "darwin",
+        env: {},
+        prompt: async (q) => {
+          promptCalls.push(q);
+          // First prompt is the exposure picker → pick "none"; second
+          // is the browser-open question → say no.
+          if (promptCalls.length === 1) return "1";
+          return "n";
+        },
+        openBrowser: () => true,
+      });
+      expect(code).toBe(0);
+      // The exposure prompt was shown.
+      expect(promptCalls.some((q) => q.toLowerCase().includes("pick"))).toBe(true);
+    } finally {
+      h.cleanup();
+    }
+  });
+
+  test("--no-expose-prompt skips the prompt entirely", async () => {
+    const h = makeHarness();
+    try {
+      writeHubPort(1939, h.configDir);
+      let exposureChained = false;
+      const promptCalls: string[] = [];
+      const code = await init({
+        configDir: h.configDir,
+        manifestPath: h.manifestPath,
+        log: () => {},
+        alive: () => false,
+        ensureHub: async () => ({ pid: 7, port: 1939, started: true }),
+        readExposeStateFn: () => undefined,
+        isTty: true,
+        platform: "darwin",
+        env: {},
+        prompt: async (q) => {
+          promptCalls.push(q);
+          return "n";
+        },
+        openBrowser: () => true,
+        exposeTailnetImpl: async () => {
+          exposureChained = true;
+          return 0;
+        },
+        exposeCloudflareImpl: async () => {
+          exposureChained = true;
+          return 0;
+        },
+        noExposePrompt: true,
+        // Suppress the new wizard-choice prompt + stub the vault-module
+        // install (hub#168 Cuts 1/4) so this pre-existing test stays
+        // focused on the exposure-prompt-skipped assertion.
+        noWizardPrompt: true,
+        installVaultModuleImpl: noopVaultInstall,
+      });
+      expect(code).toBe(0);
+      expect(exposureChained).toBe(false);
+      // No exposure prompt; only the browser-open prompt.
+      expect(promptCalls.some((q) => q.toLowerCase().includes("pick"))).toBe(false);
+    } finally {
+      h.cleanup();
+    }
+  });
+
+  test("--expose tailnet chains into tailnet without prompting", async () => {
+    const h = makeHarness();
+    try {
+      writeHubPort(1939, h.configDir);
+      let tailnetCalls = 0;
+      let cloudflareCalls = 0;
+      const promptCalls: string[] = [];
+      const code = await init({
+        configDir: h.configDir,
+        manifestPath: h.manifestPath,
+        log: () => {},
+        alive: () => false,
+        ensureHub: async () => ({ pid: 7, port: 1939, started: true }),
+        readExposeStateFn: () => undefined,
+        isTty: true,
+        platform: "linux",
+        env: {},
+        prompt: async (q) => {
+          promptCalls.push(q);
+          return "n";
+        },
+        openBrowser: () => true,
+        exposeTailnetImpl: async () => {
+          tailnetCalls += 1;
+          return 0;
+        },
+        exposeCloudflareImpl: async () => {
+          cloudflareCalls += 1;
+          return 0;
+        },
+        exposeChoice: "tailnet",
+        noWizardPrompt: true,
+        installVaultModuleImpl: noopVaultInstall,
+      });
+      expect(code).toBe(0);
+      expect(tailnetCalls).toBe(1);
+      expect(cloudflareCalls).toBe(0);
+      // No exposure prompt — the flag pre-empted it.
+      expect(promptCalls.some((q) => q.toLowerCase().includes("pick"))).toBe(false);
+    } finally {
+      h.cleanup();
+    }
+  });
+
+  test("--expose cloudflare chains into cloudflare without prompting", async () => {
+    const h = makeHarness();
+    try {
+      writeHubPort(1939, h.configDir);
+      let tailnetCalls = 0;
+      let cloudflareCalls = 0;
+      const code = await init({
+        configDir: h.configDir,
+        manifestPath: h.manifestPath,
+        log: () => {},
+        alive: () => false,
+        ensureHub: async () => ({ pid: 7, port: 1939, started: true }),
+        readExposeStateFn: () => undefined,
+        isTty: false,
+        platform: "linux",
+        env: {},
+        exposeTailnetImpl: async () => {
+          tailnetCalls += 1;
+          return 0;
+        },
+        exposeCloudflareImpl: async () => {
+          cloudflareCalls += 1;
+          return 0;
+        },
+        exposeChoice: "cloudflare",
+      });
+      expect(code).toBe(0);
+      expect(cloudflareCalls).toBe(1);
+      expect(tailnetCalls).toBe(0);
+    } finally {
+      h.cleanup();
+    }
+  });
+
+  test("--expose none skips exposure", async () => {
+    const h = makeHarness();
+    try {
+      writeHubPort(1939, h.configDir);
+      let tailnetCalls = 0;
+      let cloudflareCalls = 0;
+      const code = await init({
+        configDir: h.configDir,
+        manifestPath: h.manifestPath,
+        log: () => {},
+        alive: () => false,
+        ensureHub: async () => ({ pid: 7, port: 1939, started: true }),
+        readExposeStateFn: () => undefined,
+        isTty: false,
+        platform: "linux",
+        env: {},
+        exposeTailnetImpl: async () => {
+          tailnetCalls += 1;
+          return 0;
+        },
+        exposeCloudflareImpl: async () => {
+          cloudflareCalls += 1;
+          return 0;
+        },
+        exposeChoice: "none",
+      });
+      expect(code).toBe(0);
+      expect(tailnetCalls).toBe(0);
+      expect(cloudflareCalls).toBe(0);
+    } finally {
+      h.cleanup();
+    }
+  });
+
+  test("default selection differs by SSH heuristic (laptop → 1, server → 3)", async () => {
+    const h = makeHarness();
+    try {
+      writeHubPort(1939, h.configDir);
+
+      // Laptop: macOS, no SSH → default is "1" (none).
+      let promptLog: string[] = [];
+      // Array-based holder defeats TS control-flow narrowing — element
+      // reads on an array typed as ExposeChoice[] always come back as the
+      // declared element type, not narrowed to the last assigned literal.
+      const chained: ExposeChoice[] = ["none"];
+      const setChained = (v: ExposeChoice) => {
+        chained[0] = v;
+      };
+      await init({
+        configDir: h.configDir,
+        manifestPath: h.manifestPath,
+        log: (l) => promptLog.push(l),
+        alive: () => false,
+        ensureHub: async () => ({ pid: 7, port: 1939, started: true }),
+        readExposeStateFn: () => undefined,
+        isTty: true,
+        platform: "darwin",
+        env: {},
+        prompt: async (q) => {
+          promptLog.push(`Q: ${q}`);
+          // Empty == confirm default.
+          if (q.toLowerCase().includes("pick")) return "";
+          return "n";
+        },
+        openBrowser: () => true,
+        exposeTailnetImpl: async () => {
+          setChained("tailnet");
+          return 0;
+        },
+        exposeCloudflareImpl: async () => {
+          setChained("cloudflare");
+          return 0;
+        },
+      });
+      // Default on laptop is "none" → no chain.
+      expect(chained[0]).toBe("none");
+      // The "Pick [1]" prompt was shown (loopback as default).
+      expect(promptLog.some((l) => l.includes("Pick [1]"))).toBe(true);
+
+      // Server: Linux + SSH → default is "3" (cloudflare).
+      promptLog = [];
+      setChained("none");
+      await init({
+        configDir: h.configDir,
+        manifestPath: h.manifestPath,
+        log: (l) => promptLog.push(l),
+        alive: () => true,
+        ensureHub: async () => ({ pid: 7, port: 1939, started: false }),
+        readExposeStateFn: () => undefined,
+        isTty: true,
+        platform: "linux",
+        env: { SSH_CONNECTION: "1.2.3.4 22 5.6.7.8 22" },
+        prompt: async (q) => {
+          promptLog.push(`Q: ${q}`);
+          if (q.toLowerCase().includes("pick")) return "";
+          return "n";
+        },
+        openBrowser: () => true,
+        exposeTailnetImpl: async () => {
+          setChained("tailnet");
+          return 0;
+        },
+        exposeCloudflareImpl: async () => {
+          setChained("cloudflare");
+          return 0;
+        },
+      });
+      expect(chained[0]).toBe("cloudflare");
+      expect(promptLog.some((l) => l.includes("Pick [3]"))).toBe(true);
+    } finally {
+      h.cleanup();
+    }
+  });
+
+  test("hub already exposed → no prompt, FQDN URL printed", async () => {
+    const h = makeHarness();
+    try {
+      writeHubPort(1939, h.configDir);
+      const state: ExposeState = {
+        version: 1,
+        layer: "public",
+        mode: "path",
+        canonicalFqdn: "ec2-example.parachute.computer",
+        port: 443,
+        funnel: false,
+        entries: [],
+        hubOrigin: "https://ec2-example.parachute.computer",
+      };
+      const promptCalls: string[] = [];
+      let chained = false;
+      const logs: string[] = [];
+      const code = await init({
+        configDir: h.configDir,
+        manifestPath: h.manifestPath,
+        log: (l) => logs.push(l),
+        alive: () => false,
+        ensureHub: async () => ({ pid: 7, port: 1939, started: true }),
+        readExposeStateFn: () => state,
+        isTty: true,
+        platform: "linux",
+        env: { SSH_CONNECTION: "1.2.3.4 22 5.6.7.8 22" },
+        prompt: async (q) => {
+          promptCalls.push(q);
+          return "n";
+        },
+        openBrowser: () => true,
+        exposeTailnetImpl: async () => {
+          chained = true;
+          return 0;
+        },
+        exposeCloudflareImpl: async () => {
+          chained = true;
+          return 0;
+        },
+        noWizardPrompt: true,
+        installVaultModuleImpl: noopVaultInstall,
+      });
+      expect(code).toBe(0);
+      // No exposure chain ran, no exposure prompt asked.
+      expect(chained).toBe(false);
+      expect(promptCalls.some((q) => q.toLowerCase().includes("pick"))).toBe(false);
+      // The FQDN URL is printed.
+      expect(logs.join("\n")).toContain("https://ec2-example.parachute.computer/admin/");
+      expect(logs.join("\n")).toContain("already exposed");
+    } finally {
+      h.cleanup();
+    }
+  });
+
+  test("non-TTY → no exposure prompt, falls through to localhost", async () => {
+    const h = makeHarness();
+    try {
+      writeHubPort(1939, h.configDir);
+      let chained = false;
+      const code = await init({
+        configDir: h.configDir,
+        manifestPath: h.manifestPath,
+        log: () => {},
+        alive: () => false,
+        ensureHub: async () => ({ pid: 7, port: 1939, started: true }),
+        readExposeStateFn: () => undefined,
+        isTty: false,
+        platform: "linux",
+        env: { SSH_CONNECTION: "1.2.3.4 22 5.6.7.8 22" },
+        exposeTailnetImpl: async () => {
+          chained = true;
+          return 0;
+        },
+        exposeCloudflareImpl: async () => {
+          chained = true;
+          return 0;
+        },
+      });
+      expect(code).toBe(0);
+      expect(chained).toBe(false);
+    } finally {
+      h.cleanup();
+    }
+  });
+
+  test("exposure chain non-zero exit propagates", async () => {
+    const h = makeHarness();
+    try {
+      writeHubPort(1939, h.configDir);
+      const code = await init({
+        configDir: h.configDir,
+        manifestPath: h.manifestPath,
+        log: () => {},
+        alive: () => false,
+        ensureHub: async () => ({ pid: 7, port: 1939, started: true }),
+        readExposeStateFn: () => undefined,
+        isTty: false,
+        platform: "linux",
+        env: {},
+        exposeTailnetImpl: async () => 0,
+        exposeCloudflareImpl: async () => 2,
+        exposeChoice: "cloudflare",
+      });
+      expect(code).toBe(2);
+    } finally {
+      h.cleanup();
+    }
+  });
+
+  test("after exposure runs, the admin URL re-reads expose state for the FQDN", async () => {
+    const h = makeHarness();
+    try {
+      writeHubPort(1939, h.configDir);
+      let exposedYet = false;
+      const exposed: ExposeState = {
+        version: 1,
+        layer: "tailnet",
+        mode: "path",
+        canonicalFqdn: "box.tailnet.ts.net",
+        port: 443,
+        funnel: false,
+        entries: [],
+        hubOrigin: "https://box.tailnet.ts.net",
+      };
+      const logs: string[] = [];
+      const code = await init({
+        configDir: h.configDir,
+        manifestPath: h.manifestPath,
+        log: (l) => logs.push(l),
+        alive: () => false,
+        ensureHub: async () => ({ pid: 7, port: 1939, started: true }),
+        // Reader returns undefined the first time, then the exposed state
+        // after the chain ran. Mirrors the real on-disk flow where
+        // exposeTailnet writes expose-state.json.
+        readExposeStateFn: () => (exposedYet ? exposed : undefined),
+        isTty: false,
+        platform: "linux",
+        env: {},
+        exposeTailnetImpl: async () => {
+          exposedYet = true;
+          return 0;
+        },
+        exposeCloudflareImpl: async () => 0,
+        exposeChoice: "tailnet",
+      });
+      expect(code).toBe(0);
+      expect(logs.join("\n")).toContain("https://box.tailnet.ts.net/admin/");
+      expect(logs.join("\n")).not.toContain("http://127.0.0.1");
+    } finally {
+      h.cleanup();
+    }
+  });
+});
+
+// Type alias used only inside this test file for the heuristic test.
+type ExposeChoice = "none" | "tailnet" | "cloudflare";