@openparachute/hub 0.6.1 → 0.6.3-rc.1

package/src/__tests__/managed-unit.test.ts

@@ -0,0 +1,575 @@
+import { describe, expect, test } from "bun:test";
+import {
+  installConnectorService,
+  launchdLabel,
+  launchdPlistPath,
+  renderLaunchdPlist,
+  renderSystemdUnit,
+  systemdUnitName,
+  systemdUnitPath,
+} from "../cloudflare/connector-service.ts";
+import {
+  type ManagedUnit,
+  type ManagedUnitDeps,
+  type ManagedUnitMessages,
+  type ServiceCommandResult,
+  buildHubManagedUnit,
+  installManagedUnit,
+  removeManagedUnit,
+  renderManagedLaunchdPlist,
+  renderManagedSystemdUnit,
+} from "../managed-unit.ts";
+
+// ---------------------------------------------------------------------------
+// THE single most important test: the rendered cloudflared-connector systemd
+// unit + launchd plist must be BYTE-IDENTICAL before/after the ManagedUnit
+// extraction. The connector is live on both production boxes (gitcoin: ec2-user
+// systemd user unit + linger; our: root systemd system unit). A future
+// `expose --cloudflare` re-run must produce a behaviorally identical unit.
+//
+// These golden strings were CAPTURED from the connector renderers at the commit
+// BEFORE the extraction (Phase 2a / #496 HEAD), then frozen here. The renderers
+// must keep reproducing them character-for-character. Do NOT regenerate these
+// from current code — that would make the test tautological; they are the
+// ground truth.
+// ---------------------------------------------------------------------------
+
+const CONN_TUNNEL = "parachute-vault-example-com";
+const CONN_CONFIG = "/home/op/.parachute/cloudflared/parachute-vault-example-com/config.yml";
+const CONN_LOG = "/home/op/.parachute/cloudflared/parachute-vault-example-com/cloudflared.log";
+const CONN_CF_BIN = "/usr/local/bin/cloudflared";
+
+const GOLDEN_PLIST = `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<!-- Generated by parachute expose public --cloudflare — do not edit by hand. -->
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>computer.parachute.cloudflared.parachute-vault-example-com</string>
+  <key>ProgramArguments</key>
+  <array>
+    <string>/usr/local/bin/cloudflared</string>
+    <string>tunnel</string>
+    <string>--config</string>
+    <string>/home/op/.parachute/cloudflared/parachute-vault-example-com/config.yml</string>
+    <string>run</string>
+  </array>
+  <key>RunAtLoad</key>
+  <true/>
+  <key>KeepAlive</key>
+  <true/>
+  <key>StandardOutPath</key>
+  <string>/home/op/.parachute/cloudflared/parachute-vault-example-com/cloudflared.log</string>
+  <key>StandardErrorPath</key>
+  <string>/home/op/.parachute/cloudflared/parachute-vault-example-com/cloudflared.log</string>
+</dict>
+</plist>
+`;
+
+const GOLDEN_SYSTEMD_USER = `# Generated by parachute expose public --cloudflare — do not edit by hand.
+[Unit]
+Description=Parachute Cloudflare connector (parachute-vault-example-com)
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+ExecStart=/usr/local/bin/cloudflared tunnel --config /home/op/.parachute/cloudflared/parachute-vault-example-com/config.yml run
+Restart=always
+RestartSec=5
+
+[Install]
+WantedBy=default.target
+`;
+
+const GOLDEN_SYSTEMD_ROOT = `# Generated by parachute expose public --cloudflare — do not edit by hand.
+[Unit]
+Description=Parachute Cloudflare connector (parachute-vault-example-com)
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=op
+ExecStart=/usr/local/bin/cloudflared tunnel --config /home/op/.parachute/cloudflared/parachute-vault-example-com/config.yml run
+Restart=always
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+`;
+
+describe("connector-output regression (BYTE-IDENTICAL — connector is in production)", () => {
+  test("launchd plist is character-identical to the pre-extraction golden", () => {
+    const plist = renderLaunchdPlist({
+      tunnelName: CONN_TUNNEL,
+      cloudflaredPath: CONN_CF_BIN,
+      configPath: CONN_CONFIG,
+      logPath: CONN_LOG,
+    });
+    expect(plist).toBe(GOLDEN_PLIST);
+  });
+
+  test("systemd USER unit (root:false) is character-identical to the golden", () => {
+    const unit = renderSystemdUnit({
+      tunnelName: CONN_TUNNEL,
+      cloudflaredPath: CONN_CF_BIN,
+      configPath: CONN_CONFIG,
+      logPath: CONN_LOG,
+      root: false,
+      userName: "op",
+    });
+    expect(unit).toBe(GOLDEN_SYSTEMD_USER);
+  });
+
+  test("systemd SYSTEM unit (root:true, User=op) is character-identical to the golden", () => {
+    const unit = renderSystemdUnit({
+      tunnelName: CONN_TUNNEL,
+      cloudflaredPath: CONN_CF_BIN,
+      configPath: CONN_CONFIG,
+      logPath: CONN_LOG,
+      root: true,
+      userName: "op",
+    });
+    expect(unit).toBe(GOLDEN_SYSTEMD_ROOT);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// Generalized renderers — the env block + crash-loop ceiling. The connector
+// (empty env, no ceiling) must render exactly as today; the populated case is
+// the hub-unit shape.
+// ---------------------------------------------------------------------------
+
+/** A minimal connector-shaped descriptor (empty env, no crash-loop). */
+function connectorShapedUnit(over: Partial<ManagedUnit> = {}): ManagedUnit {
+  return {
+    launchdLabel: "computer.parachute.cloudflared.x",
+    systemdUnitName: "parachute-cloudflared-x.service",
+    headerComment: "Generated by parachute expose public --cloudflare — do not edit by hand.",
+    systemdDescription: "Parachute Cloudflare connector (x)",
+    execStart: ["/usr/local/bin/cloudflared", "tunnel", "--config", "/cfg", "run"],
+    env: {},
+    logPath: "/log",
+    runAsInvokingUserOnSystemUnit: true,
+    ...over,
+  };
+}
+
+describe("renderManagedSystemdUnit — env block", () => {
+  test("EMPTY env → emits NO Environment= line (connector parity)", () => {
+    const unit = renderManagedSystemdUnit(connectorShapedUnit(), { root: false, userName: "op" });
+    expect(unit).not.toContain("Environment=");
+    // The line immediately before ExecStart is the [Service]/Type lines — no
+    // env wedged in.
+    expect(unit).toContain("Type=simple\nExecStart=");
+  });
+
+  test("populated env → one Environment=KEY=VAL line per entry, after User=", () => {
+    const unit = renderManagedSystemdUnit(
+      connectorShapedUnit({
+        env: {
+          PARACHUTE_HOME: "/home/op/.parachute",
+          PORT: "1939",
+          PATH: "/home/op/.bun/bin:/usr/bin",
+          BUN_INSTALL: "/home/op/.bun",
+        },
+      }),
+      { root: true, userName: "op" },
+    );
+    expect(unit).toContain("Environment=PARACHUTE_HOME=/home/op/.parachute");
+    expect(unit).toContain("Environment=PORT=1939");
+    expect(unit).toContain("Environment=PATH=/home/op/.bun/bin:/usr/bin");
+    expect(unit).toContain("Environment=BUN_INSTALL=/home/op/.bun");
+    // env lines sit after User= (root/system unit) and before ExecStart.
+    expect(unit).toContain("User=op\nEnvironment=PARACHUTE_HOME=");
+    expect(unit.indexOf("Environment=")).toBeLessThan(unit.indexOf("ExecStart="));
+  });
+});
+
+describe("renderManagedSystemdUnit — crash-loop ceiling", () => {
+  test("unset crashLoop → NO StartLimit lines (connector parity)", () => {
+    const unit = renderManagedSystemdUnit(connectorShapedUnit(), { root: false, userName: "op" });
+    expect(unit).not.toContain("StartLimit");
+  });
+
+  test("set crashLoop → StartLimitIntervalSec + StartLimitBurst after RestartSec", () => {
+    const unit = renderManagedSystemdUnit(
+      connectorShapedUnit({ crashLoop: { intervalSec: 300, burst: 5, throttleIntervalSec: 10 } }),
+      { root: false, userName: "op" },
+    );
+    expect(unit).toContain("StartLimitIntervalSec=300");
+    expect(unit).toContain("StartLimitBurst=5");
+    expect(unit).toContain(
+      "RestartSec=5\nStartLimitIntervalSec=300\nStartLimitBurst=5\n\n[Install]",
+    );
+  });
+});
+
+describe("renderManagedLaunchdPlist — env block + throttle", () => {
+  test("EMPTY env + no crashLoop → NO EnvironmentVariables dict, NO ThrottleInterval", () => {
+    const plist = renderManagedLaunchdPlist(connectorShapedUnit());
+    expect(plist).not.toContain("EnvironmentVariables");
+    expect(plist).not.toContain("ThrottleInterval");
+    // </array> flows straight into RunAtLoad (no env dict wedged in).
+    expect(plist).toContain("  </array>\n  <key>RunAtLoad</key>");
+    // KeepAlive flows straight into StandardOutPath (no throttle wedged in).
+    expect(plist).toContain("<key>KeepAlive</key>\n  <true/>\n  <key>StandardOutPath</key>");
+  });
+
+  test("populated env + crashLoop → EnvironmentVariables dict + ThrottleInterval", () => {
+    const plist = renderManagedLaunchdPlist(
+      connectorShapedUnit({
+        env: {
+          PARACHUTE_HOME: "/home/op/.parachute",
+          PORT: "1939",
+          PATH: "/home/op/.bun/bin",
+          BUN_INSTALL: "/home/op/.bun",
+        },
+        crashLoop: { intervalSec: 300, burst: 5, throttleIntervalSec: 10 },
+      }),
+    );
+    expect(plist).toContain("<key>EnvironmentVariables</key>");
+    expect(plist).toContain("<key>PARACHUTE_HOME</key>\n    <string>/home/op/.parachute</string>");
+    expect(plist).toContain("<key>PORT</key>\n    <string>1939</string>");
+    expect(plist).toContain("<key>PATH</key>\n    <string>/home/op/.bun/bin</string>");
+    expect(plist).toContain("<key>BUN_INSTALL</key>\n    <string>/home/op/.bun</string>");
+    expect(plist).toContain("<key>ThrottleInterval</key>\n  <integer>10</integer>");
+    // env dict sits between </array> and RunAtLoad.
+    expect(plist.indexOf("EnvironmentVariables")).toBeLessThan(plist.indexOf("RunAtLoad"));
+  });
+});
+
+// ---------------------------------------------------------------------------
+// Injectable deps for installManagedUnit / removeManagedUnit tests.
+// ---------------------------------------------------------------------------
+
+interface FakeDepsState {
+  deps: ManagedUnitDeps;
+  calls: string[][];
+  files: Map<string, string>;
+}
+
+function fakeDeps(
+  over: Partial<ManagedUnitDeps> & { runResults?: ServiceCommandResult[] } = {},
+): FakeDepsState {
+  const calls: string[][] = [];
+  const files = new Map<string, string>();
+  let runIdx = 0;
+  const ok: ServiceCommandResult = { code: 0, stdout: "", stderr: "" };
+  const deps: ManagedUnitDeps = {
+    platform: over.platform ?? "darwin",
+    getuid: over.getuid ?? (() => 501),
+    homeDir: over.homeDir ?? (() => "/home/op"),
+    userName: over.userName ?? (() => "op"),
+    which:
+      over.which ??
+      ((b) => {
+        if (b === "bun") return "/home/op/.bun/bin/bun";
+        if (b === "launchctl" || b === "systemctl" || b === "loginctl") return `/usr/bin/${b}`;
+        return null;
+      }),
+    run:
+      over.run ??
+      ((cmd) => {
+        calls.push([...cmd]);
+        const r = over.runResults?.[runIdx++];
+        return r ?? ok;
+      }),
+    writeFile: over.writeFile ?? ((p, c) => void files.set(p, c)),
+    removeFile: over.removeFile ?? ((p) => void files.delete(p)),
+    readFile: over.readFile ?? ((p) => files.get(p)),
+    exists: over.exists ?? ((p) => files.has(p)),
+  };
+  return { deps, calls, files };
+}
+
+const HUB_MESSAGES: ManagedUnitMessages = {
+  launchctlMissing: "launchctl not found",
+  systemctlMissing: "systemctl not found",
+  lingerWarning: "could not enable lingering",
+  writeFailedPrefix: "Failed to write unit",
+  launchctlLoadFailedPrefix: "launchctl could not load",
+  daemonReloadFailedPrefix: "daemon-reload failed",
+  enableFailedPrefix: "enable --now failed",
+  launchdInstalled: (label, started) => `Installed launchd ${label} (started=${started})`,
+  systemdInstalled: (unitName, root, started) =>
+    `Installed systemd ${root ? "system" : "user"} ${unitName} (started=${started})`,
+};
+
+function hubUnit(deps: ManagedUnitDeps): ManagedUnit {
+  return buildHubManagedUnit({
+    parachuteHome: "/home/op/.parachute",
+    bunInstall: "/home/op/.bun",
+    path: "/home/op/.bun/bin:/usr/local/bin:/usr/bin:/bin",
+    cliPath: "/home/op/parachute-hub/src/cli.ts",
+    logPath: "/home/op/.parachute/hub/logs/hub.log",
+    deps,
+  });
+}
+
+describe("installManagedUnit — start:boolean (§7.1)", () => {
+  test("systemd start:false → daemon-reload but NOT enable --now", () => {
+    const f = fakeDeps({ platform: "linux", getuid: () => 0, userName: () => "root" });
+    const result = installManagedUnit({
+      unit: hubUnit(f.deps),
+      deps: f.deps,
+      messages: HUB_MESSAGES,
+      start: false,
+    });
+    expect(result.outcome).toBe("installed");
+    expect(result.messages[0]).toContain("started=false");
+    // daemon-reload ran...
+    expect(f.calls).toContainEqual(["systemctl", "daemon-reload"]);
+    // ...but NO enable --now.
+    expect(f.calls.some((c) => c.includes("enable"))).toBe(false);
+    // unit file IS written.
+    const unitPath = systemdUnitPath("hub-ignored", "/home/op", true).replace(
+      "parachute-cloudflared-hub-ignored.service",
+      "parachute-hub.service",
+    );
+    expect(f.files.has(unitPath)).toBe(true);
+  });
+
+  test("systemd start:true → full daemon-reload + enable --now sequence (default)", () => {
+    const f = fakeDeps({ platform: "linux", getuid: () => 0, userName: () => "root" });
+    const result = installManagedUnit({
+      unit: hubUnit(f.deps),
+      deps: f.deps,
+      messages: HUB_MESSAGES,
+    });
+    expect(result.outcome).toBe("installed");
+    expect(result.messages[0]).toContain("started=true");
+    expect(f.calls).toContainEqual(["systemctl", "daemon-reload"]);
+    expect(f.calls).toContainEqual(["systemctl", "enable", "--now", "parachute-hub.service"]);
+  });
+
+  test("launchd start:false → writes plist but NOT bootstrap/kickstart", () => {
+    const f = fakeDeps({ platform: "darwin", getuid: () => 501 });
+    const result = installManagedUnit({
+      unit: hubUnit(f.deps),
+      deps: f.deps,
+      messages: HUB_MESSAGES,
+      start: false,
+    });
+    expect(result.outcome).toBe("installed");
+    expect(result.messages[0]).toContain("started=false");
+    const plistPath = launchdPlistPath("hub-ignored", "/home/op").replace(
+      "computer.parachute.cloudflared.hub-ignored.plist",
+      "computer.parachute.hub.plist",
+    );
+    // The plist is written to the correct path AND carries the rendered content
+    // (not just an empty key) — start:false skips the launch but still installs.
+    expect(f.files.has(plistPath)).toBe(true);
+    expect(f.files.get(plistPath)).toBe(renderManagedLaunchdPlist(hubUnit(f.deps)));
+    // No launchctl bootout/bootstrap/kickstart in start:false mode.
+    expect(f.calls.some((c) => c[0] === "launchctl")).toBe(false);
+  });
+
+  test("launchd start:true → writes plist AND bootout+bootstrap+kickstart (default)", () => {
+    const f = fakeDeps({ platform: "darwin", getuid: () => 501 });
+    const result = installManagedUnit({
+      unit: hubUnit(f.deps),
+      deps: f.deps,
+      messages: HUB_MESSAGES,
+    });
+    expect(result.outcome).toBe("installed");
+    expect(result.messages[0]).toContain("started=true");
+    expect(f.calls).toContainEqual(["launchctl", "bootout", "gui/501/computer.parachute.hub"]);
+    expect(f.calls.some((c) => c[1] === "bootstrap")).toBe(true);
+    expect(f.calls).toContainEqual([
+      "launchctl",
+      "kickstart",
+      "-k",
+      "gui/501/computer.parachute.hub",
+    ]);
+  });
+
+  test("systemd start:false still enables linger (boot-survival nicety, non-root)", () => {
+    const f = fakeDeps({ platform: "linux", getuid: () => 1000, userName: () => "op" });
+    installManagedUnit({
+      unit: hubUnit(f.deps),
+      deps: f.deps,
+      messages: HUB_MESSAGES,
+      start: false,
+    });
+    expect(f.calls).toContainEqual(["loginctl", "enable-linger", "op"]);
+    // user-scoped daemon-reload, no enable.
+    expect(f.calls).toContainEqual(["systemctl", "--user", "daemon-reload"]);
+    expect(f.calls.some((c) => c.includes("enable"))).toBe(false);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// buildHubManagedUnit — the §4.1 hub-unit shape (NOT wired into any command).
+// ---------------------------------------------------------------------------
+
+describe("buildHubManagedUnit — §4.1 hub-unit shape", () => {
+  test("descriptor: abs bun resolved via which, ExecStart = [bun, cli, serve]", () => {
+    const f = fakeDeps({ platform: "linux" });
+    const unit = hubUnit(f.deps);
+    expect(unit.launchdLabel).toBe("computer.parachute.hub");
+    expect(unit.systemdUnitName).toBe("parachute-hub.service");
+    expect(unit.execStart).toEqual([
+      "/home/op/.bun/bin/bun",
+      "/home/op/parachute-hub/src/cli.ts",
+      "serve",
+    ]);
+    expect(unit.crashLoop).toEqual({ intervalSec: 300, burst: 5, throttleIntervalSec: 10 });
+    expect(unit.runAsInvokingUserOnSystemUnit).toBe(true);
+  });
+
+  test("throws (fail-loud) when bun is unresolvable — never bakes a broken ExecStart", () => {
+    // launchd/systemd don't search $PATH; a literal "bun" fallback would produce
+    // a unit that fails to start with a cryptic error. Refuse to build it.
+    const f = fakeDeps({
+      platform: "linux",
+      which: (b) => (b === "bun" ? null : `/usr/bin/${b}`),
+    });
+    expect(() => hubUnit(f.deps)).toThrow(/'bun' not found on PATH/);
+  });
+
+  test("env carries the 4 vars and INTENTIONALLY OMITS PARACHUTE_HUB_ORIGIN", () => {
+    const f = fakeDeps({ platform: "linux" });
+    const unit = hubUnit(f.deps);
+    expect(unit.env).toEqual({
+      PARACHUTE_HOME: "/home/op/.parachute",
+      PORT: "1939",
+      PATH: "/home/op/.bun/bin:/usr/local/bin:/usr/bin:/bin",
+      BUN_INSTALL: "/home/op/.bun",
+    });
+    expect(unit.env.PARACHUTE_HUB_ORIGIN).toBeUndefined();
+  });
+
+  test("PARACHUTE_HOME is the captured param, NOT the default (§4.2)", () => {
+    const f = fakeDeps({ platform: "linux" });
+    const unit = buildHubManagedUnit({
+      parachuteHome: "/custom/home/.parachute",
+      bunInstall: "/home/op/.bun",
+      path: "/home/op/.bun/bin",
+      cliPath: "/x/src/cli.ts",
+      logPath: "/x.log",
+      deps: f.deps,
+    });
+    expect(unit.env.PARACHUTE_HOME).toBe("/custom/home/.parachute");
+  });
+
+  test("default port is 1939; override is respected", () => {
+    const f = fakeDeps({ platform: "linux" });
+    const unit = buildHubManagedUnit({
+      parachuteHome: "/home/op/.parachute",
+      port: 2939,
+      bunInstall: "/home/op/.bun",
+      path: "/p",
+      cliPath: "/x/src/cli.ts",
+      logPath: "/x.log",
+      deps: f.deps,
+    });
+    expect(unit.env.PORT).toBe("2939");
+  });
+
+  test("rendered systemd SYSTEM unit: 4 Environment= vars, User= present, StartLimit present", () => {
+    const f = fakeDeps({ platform: "linux", getuid: () => 0, userName: () => "op" });
+    const unit = renderManagedSystemdUnit(hubUnit(f.deps), { root: true, userName: "op" });
+    expect(unit).toContain("Description=Parachute hub (serve + supervisor)");
+    expect(unit).toContain("User=op");
+    expect(unit).toContain("Environment=PARACHUTE_HOME=/home/op/.parachute");
+    expect(unit).toContain("Environment=PORT=1939");
+    expect(unit).toContain("Environment=PATH=/home/op/.bun/bin:/usr/local/bin:/usr/bin:/bin");
+    expect(unit).toContain("Environment=BUN_INSTALL=/home/op/.bun");
+    expect(unit).not.toContain("PARACHUTE_HUB_ORIGIN");
+    expect(unit).toContain("StartLimitIntervalSec=300");
+    expect(unit).toContain("StartLimitBurst=5");
+    expect(unit).toContain(
+      "ExecStart=/home/op/.bun/bin/bun /home/op/parachute-hub/src/cli.ts serve",
+    );
+    expect(unit).toContain("WantedBy=multi-user.target");
+  });
+
+  test("rendered systemd USER unit: NO User= line (User= is system-only)", () => {
+    const f = fakeDeps({ platform: "linux", getuid: () => 1000, userName: () => "op" });
+    const unit = renderManagedSystemdUnit(hubUnit(f.deps), { root: false, userName: "op" });
+    expect(unit).not.toContain("User=");
+    expect(unit).toContain("Environment=PARACHUTE_HOME=/home/op/.parachute");
+    expect(unit).toContain("WantedBy=default.target");
+  });
+
+  test("rendered launchd plist: EnvironmentVariables dict (4 vars) + ThrottleInterval + abs ProgramArguments", () => {
+    const f = fakeDeps({ platform: "darwin" });
+    const plist = renderManagedLaunchdPlist(hubUnit(f.deps));
+    expect(plist).toContain("<key>Label</key>\n  <string>computer.parachute.hub</string>");
+    expect(plist).toContain("<string>/home/op/.bun/bin/bun</string>");
+    expect(plist).toContain("<string>/home/op/parachute-hub/src/cli.ts</string>");
+    expect(plist).toContain("<string>serve</string>");
+    expect(plist).toContain("<key>EnvironmentVariables</key>");
+    expect(plist).toContain("<key>PARACHUTE_HOME</key>\n    <string>/home/op/.parachute</string>");
+    expect(plist).toContain("<key>PORT</key>\n    <string>1939</string>");
+    expect(plist).toContain("<key>BUN_INSTALL</key>\n    <string>/home/op/.bun</string>");
+    expect(plist).not.toContain("PARACHUTE_HUB_ORIGIN");
+    expect(plist).toContain("<key>ThrottleInterval</key>\n  <integer>10</integer>");
+  });
+});
+
+describe("removeManagedUnit (smoke — connector delegates here)", () => {
+  test("darwin: boots out + removes plist", () => {
+    const f = fakeDeps({ platform: "darwin", getuid: () => 501 });
+    const label = "computer.parachute.hub";
+    const plistPath = "/home/op/Library/LaunchAgents/computer.parachute.hub.plist";
+    f.files.set(plistPath, "<plist/>");
+    const result = removeManagedUnit({
+      launchdLabel: label,
+      systemdUnitName: "parachute-hub.service",
+      deps: f.deps,
+      removedLaunchdMessage: (l) => `Removed ${l}`,
+      removedSystemdMessage: (u) => `Removed ${u}`,
+    });
+    expect(result.removed).toBe(true);
+    expect(f.files.has(plistPath)).toBe(false);
+    expect(f.calls).toContainEqual(["launchctl", "bootout", `gui/501/${label}`]);
+  });
+
+  test("no-op (no throw) when no unit file exists", () => {
+    const f = fakeDeps({ platform: "darwin" });
+    const result = removeManagedUnit({
+      launchdLabel: "computer.parachute.hub",
+      systemdUnitName: "parachute-hub.service",
+      deps: f.deps,
+      removedLaunchdMessage: (l) => `Removed ${l}`,
+      removedSystemdMessage: (u) => `Removed ${u}`,
+    });
+    expect(result.removed).toBe(false);
+    expect(f.calls.length).toBe(0);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// Cross-check: the connector still installs end-to-end through the generalized
+// machinery (start:true default), proving the delegation path is wired.
+// ---------------------------------------------------------------------------
+
+describe("installConnectorService still drives the generalized installer (start:true)", () => {
+  test("macOS: writes the connector plist + bootstraps (unchanged behavior)", () => {
+    const f = fakeDeps({
+      platform: "darwin",
+      getuid: () => 501,
+      which: (b) => {
+        if (b === "cloudflared") return CONN_CF_BIN;
+        if (b === "launchctl") return "/bin/launchctl";
+        return null;
+      },
+    });
+    const result = installConnectorService({
+      tunnelName: CONN_TUNNEL,
+      configPath: CONN_CONFIG,
+      logPath: CONN_LOG,
+      deps: f.deps,
+    });
+    expect(result.outcome).toBe("installed");
+    expect(result.kind).toBe("launchd");
+    const plistPath = launchdPlistPath(CONN_TUNNEL, "/home/op");
+    // The connector plist written through the generalized path is byte-identical
+    // to the frozen golden.
+    expect(f.files.get(plistPath)).toBe(GOLDEN_PLIST);
+    expect(f.calls).toContainEqual(["launchctl", "bootstrap", "gui/501", plistPath]);
+  });
+});