@openparachute/hub 0.6.3-rc.1 → 0.6.3-rc.2

package/src/__tests__/migrate-offer.test.ts

@@ -0,0 +1,240 @@
+import { describe, expect, test } from "bun:test";
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import type { CutoverResult } from "../commands/migrate-cutover.ts";
+import { hasPriorDetachedInstall, offerMigrateToSupervised } from "../migrate-offer.ts";
+import { writePid } from "../process-state.ts";
+
+/**
+ * Sandboxed §7.5 auto-detect-and-offer tests. Every offer runs against a fresh
+ * tmp `PARACHUTE_HOME` with stubbed unit-detection / cutover / prompt / TTY —
+ * no real prompt, no real cutover, no touching `~/.parachute`. The only real fs
+ * is seeding pidfiles + services.json (via `writePid`) so the DETECTOR reads
+ * genuine on-disk detached-era state.
+ */
+interface Harness {
+  configDir: string;
+  manifestPath: string;
+  cleanup: () => void;
+}
+
+function makeHarness(): Harness {
+  const dir = mkdtempSync(join(tmpdir(), "pcli-offer-"));
+  return {
+    configDir: dir,
+    manifestPath: join(dir, "services.json"),
+    cleanup: () => rmSync(dir, { recursive: true, force: true }),
+  };
+}
+
+function seedManifest(manifestPath: string, services: Array<{ name: string; port: number }>): void {
+  const full = services.map((s) => ({
+    name: s.name,
+    port: s.port,
+    paths: [`/${s.name}`],
+    health: "/health",
+    version: "1.0.0",
+  }));
+  writeFileSync(manifestPath, JSON.stringify({ services: full }));
+}
+
+function seedHubPidfile(configDir: string, pid = 12345): void {
+  mkdirSync(join(configDir, "hub", "run"), { recursive: true });
+  writePid("hub", pid, configDir);
+}
+
+const migratedResult: CutoverResult = { outcome: "migrated", port: 1939, messages: ["✓ migrated"] };
+
+describe("hasPriorDetachedInstall (the §7.5 (b) detector)", () => {
+  test("true when a hub pidfile exists", () => {
+    const h = makeHarness();
+    try {
+      seedHubPidfile(h.configDir);
+      expect(hasPriorDetachedInstall(h.configDir, h.manifestPath)).toBe(true);
+    } finally {
+      h.cleanup();
+    }
+  });
+
+  test("true when a module pidfile exists", () => {
+    const h = makeHarness();
+    try {
+      seedManifest(h.manifestPath, [{ name: "parachute-vault", port: 1940 }]);
+      mkdirSync(join(h.configDir, "vault", "run"), { recursive: true });
+      writePid("vault", 999, h.configDir);
+      expect(hasPriorDetachedInstall(h.configDir, h.manifestPath)).toBe(true);
+    } finally {
+      h.cleanup();
+    }
+  });
+
+  test("FALSE on a clean/supervised box — services.json alone is NOT enough", () => {
+    const h = makeHarness();
+    try {
+      // A configured box with services.json but NO pidfiles (the supervised
+      // shape — children tracked in-process). Must not false-positive.
+      seedManifest(h.manifestPath, [{ name: "parachute-vault", port: 1940 }]);
+      expect(hasPriorDetachedInstall(h.configDir, h.manifestPath)).toBe(false);
+    } finally {
+      h.cleanup();
+    }
+  });
+
+  test("FALSE on a brand-new box (no services.json, no pidfiles)", () => {
+    const h = makeHarness();
+    try {
+      expect(hasPriorDetachedInstall(h.configDir, h.manifestPath)).toBe(false);
+    } finally {
+      h.cleanup();
+    }
+  });
+});
+
+describe("offerMigrateToSupervised — when NOT to offer", () => {
+  test("no offer when a hub unit IS installed (already supervised)", async () => {
+    const h = makeHarness();
+    try {
+      seedHubPidfile(h.configDir);
+      let cutoverCalled = false;
+      const result = await offerMigrateToSupervised({
+        configDir: h.configDir,
+        manifestPath: h.manifestPath,
+        log: () => {},
+        isHubUnitInstalled: () => true, // a unit exists
+        hasPriorDetached: () => true,
+        cutover: async () => {
+          cutoverCalled = true;
+          return migratedResult;
+        },
+        prompt: async () => "y",
+        isTty: true,
+      });
+      expect(result.outcome).toBe("no-offer");
+      expect(cutoverCalled).toBe(false);
+    } finally {
+      h.cleanup();
+    }
+  });
+
+  test("no offer when there is no prior-detached evidence (clean box)", async () => {
+    const h = makeHarness();
+    try {
+      const result = await offerMigrateToSupervised({
+        configDir: h.configDir,
+        manifestPath: h.manifestPath,
+        log: () => {},
+        isHubUnitInstalled: () => false,
+        hasPriorDetached: () => false, // clean box
+        prompt: async () => {
+          throw new Error("prompt must not be called on a clean box");
+        },
+        isTty: true,
+      });
+      expect(result.outcome).toBe("no-offer");
+    } finally {
+      h.cleanup();
+    }
+  });
+});
+
+describe("offerMigrateToSupervised — interactive (TTY)", () => {
+  test("accept → runs the cutover, reports migrated", async () => {
+    const h = makeHarness();
+    try {
+      let cutoverCalled = false;
+      const result = await offerMigrateToSupervised({
+        configDir: h.configDir,
+        manifestPath: h.manifestPath,
+        log: () => {},
+        isHubUnitInstalled: () => false,
+        hasPriorDetached: () => true,
+        cutover: async () => {
+          cutoverCalled = true;
+          return migratedResult;
+        },
+        prompt: async () => "y",
+        isTty: true,
+      });
+      expect(cutoverCalled).toBe(true);
+      expect(result.outcome).toBe("migrated");
+    } finally {
+      h.cleanup();
+    }
+  });
+
+  test("decline → does NOT run the cutover", async () => {
+    const h = makeHarness();
+    try {
+      let cutoverCalled = false;
+      const log: string[] = [];
+      const result = await offerMigrateToSupervised({
+        configDir: h.configDir,
+        manifestPath: h.manifestPath,
+        log: (l) => log.push(l),
+        isHubUnitInstalled: () => false,
+        hasPriorDetached: () => true,
+        cutover: async () => {
+          cutoverCalled = true;
+          return migratedResult;
+        },
+        prompt: async () => "n",
+        isTty: true,
+      });
+      expect(cutoverCalled).toBe(false);
+      expect(result.outcome).toBe("declined");
+      expect(log.join("\n")).toContain("parachute migrate --to-supervised");
+    } finally {
+      h.cleanup();
+    }
+  });
+
+  test("accept but cutover fails → migrate-failed (NOT migrated)", async () => {
+    const h = makeHarness();
+    try {
+      const result = await offerMigrateToSupervised({
+        configDir: h.configDir,
+        manifestPath: h.manifestPath,
+        log: () => {},
+        isHubUnitInstalled: () => false,
+        hasPriorDetached: () => true,
+        cutover: async () => ({ outcome: "port-stuck", port: 1939, messages: ["stuck"] }),
+        prompt: async () => "yes",
+        isTty: true,
+      });
+      expect(result.outcome).toBe("migrate-failed");
+    } finally {
+      h.cleanup();
+    }
+  });
+});
+
+describe("offerMigrateToSupervised — non-interactive (no TTY)", () => {
+  test("PRINTS the exact command and NEVER runs the cutover", async () => {
+    const h = makeHarness();
+    try {
+      let cutoverCalled = false;
+      const log: string[] = [];
+      const result = await offerMigrateToSupervised({
+        configDir: h.configDir,
+        manifestPath: h.manifestPath,
+        log: (l) => log.push(l),
+        isHubUnitInstalled: () => false,
+        hasPriorDetached: () => true,
+        cutover: async () => {
+          cutoverCalled = true;
+          return migratedResult;
+        },
+        prompt: async () => {
+          throw new Error("prompt must not be called in a non-TTY context");
+        },
+        isTty: false,
+      });
+      expect(result.outcome).toBe("printed");
+      expect(cutoverCalled).toBe(false);
+      expect(log.join("\n")).toContain("parachute migrate --to-supervised");
+    } finally {
+      h.cleanup();
+    }
+  });
+});

package/src/__tests__/migrate.test.ts

@@ -439,6 +439,62 @@ describe("migrate — interactive + flag behavior", () => {
     }
   });
 
+  test("§7.3 refuses while a UNIT-MANAGED hub runs (no pidfile, detected via manager)", async () => {
+    const h = makeHarness();
+    try {
+      seedSafelist(h.configDir);
+      // NO hub pidfile — this is a supervised/unit-managed hub. Before the §7.3
+      // fix the refuse-while-running guard FAILED OPEN here and migrate would
+      // archive ~/.parachute out from under the live hub.
+      touch(join(h.configDir, "daily.db"), "X");
+
+      const logs: string[] = [];
+      const code = await migrate({
+        configDir: h.configDir,
+        now: () => APRIL_19,
+        log: (l) => logs.push(l),
+        prompt: async () => {
+          throw new Error("prompt must not be called");
+        },
+        yes: true,
+        isTty: true,
+        // No pidfile alive; the manager reports the hub unit active.
+        alive: () => false,
+        hubUnitState: () => ({ state: "active" }),
+      });
+      expect(code).toBe(1);
+      expect(logs.join("\n")).toMatch(/services are currently running/i);
+      // No archive happened — the guard held.
+      expect(existsSync(join(h.configDir, ".archive-2026-04-19"))).toBe(false);
+      expect(existsSync(join(h.configDir, "daily.db"))).toBe(true);
+    } finally {
+      h.cleanup();
+    }
+  });
+
+  test("§7.3 archive PROCEEDS when the manager reports the hub inactive (no false-positive)", async () => {
+    const h = makeHarness();
+    try {
+      seedSafelist(h.configDir);
+      touch(join(h.configDir, "daily.db"), "X");
+
+      const code = await migrate({
+        configDir: h.configDir,
+        now: () => APRIL_19,
+        log: () => {},
+        yes: true,
+        isTty: true,
+        alive: () => false,
+        hubUnitState: () => ({ state: "inactive" }),
+      });
+      expect(code).toBe(0);
+      // The sweep ran — daily.db is archived.
+      expect(existsSync(join(h.configDir, ".archive-2026-04-19", "daily.db"))).toBe(true);
+    } finally {
+      h.cleanup();
+    }
+  });
+
   test("refuses non-TTY without --yes (CI / pipe safety)", async () => {
     const h = makeHarness();
     try {
@@ -713,7 +769,83 @@ describe("listRunningServices", () => {
         h.configDir,
         join(h.configDir, "services.json"),
         () => false,
+        // Explicit no-unit stub so this stays deterministic even on a dev box
+        // that happens to have a hub unit installed (the §7.3 manager check).
+        () => ({ state: "no-unit" }),
+      );
+      expect(running).toEqual([]);
+    } finally {
+      h.cleanup();
+    }
+  });
+
+  test("§7.3 archive-guard: a unit-managed hub (no pidfile) is detected RUNNING via the manager", () => {
+    const h = makeHarness();
+    try {
+      seedSafelist(h.configDir);
+      // NO hub pidfile (unit-managed hubs don't write one) → the pidfile check
+      // (alive => false) reports the hub as not-running. Before the fix this
+      // FAILED OPEN. The platform-manager check sees `active` and holds.
+      const running = listRunningServices(
+        h.configDir,
+        join(h.configDir, "services.json"),
+        () => false,
+        () => ({ state: "active" }),
+      );
+      expect(running).toContain("hub");
+    } finally {
+      h.cleanup();
+    }
+  });
+
+  test("§7.3 archive-guard: `activating` also reads as running", () => {
+    const h = makeHarness();
+    try {
+      seedSafelist(h.configDir);
+      const running = listRunningServices(
+        h.configDir,
+        join(h.configDir, "services.json"),
+        () => false,
+        () => ({ state: "activating" }),
+      );
+      expect(running).toContain("hub");
+    } finally {
+      h.cleanup();
+    }
+  });
+
+  test("§7.3 archive-guard: `failed` / `inactive` / `no-manager` are NOT running", () => {
+    const h = makeHarness();
+    try {
+      seedSafelist(h.configDir);
+      for (const state of ["failed", "inactive", "no-manager", "no-unit", "unknown"] as const) {
+        const running = listRunningServices(
+          h.configDir,
+          join(h.configDir, "services.json"),
+          () => false,
+          () => ({ state }),
+        );
+        expect(running).not.toContain("hub");
+      }
+    } finally {
+      h.cleanup();
+    }
+  });
+
+  test("§7.3 archive-guard: a manager-query that throws never crashes the guard (fails closed-ish)", () => {
+    const h = makeHarness();
+    try {
+      seedSafelist(h.configDir);
+      const running = listRunningServices(
+        h.configDir,
+        join(h.configDir, "services.json"),
+        () => false,
+        () => {
+          throw new Error("systemctl exploded");
+        },
       );
+      // The throw is swallowed; the pidfile check (no pid) governs → not running.
+      // (The guard must not crash; it just gets no extra signal from the manager.)
       expect(running).toEqual([]);
     } finally {
       h.cleanup();

package/src/__tests__/status-supervisor.test.ts

@@ -12,12 +12,12 @@ import {
 import { upsertService } from "../services-manifest.ts";
 
 /**
- * Phase 3c (design §6.4): on a UNIT-MANAGED box `status` reads the hub row from
- * the platform manager + `/health` and the module rows from the running
- * supervisor (`GET /api/modules`). Everything below is driven through the
- * `supervisor` seams — no real launchd/systemd/socket/HTTP/db call. The detached
- * arm is exercised separately in `status.test.ts` (those tests omit the
- * `supervisor` block entirely, so they keep the pidfile readout unchanged).
+ * Phase 5b (design §6.4): `status` reads the hub row from the platform manager +
+ * `/health` and the module rows from the running supervisor (`GET /api/modules`)
+ * — the ONLY runtime now that the detached pidfile arm is retired. Everything
+ * below is driven through the `supervisor` seams — no real launchd/systemd/
+ * socket/HTTP/db call. The manifest-derived rendering (URLs, version, persisted
+ * start-error) is covered in `status.test.ts` (also supervised-arm now).
  */
 
 function makeTempPath(): { path: string; cleanup: () => void; configDir: string } {
@@ -90,7 +90,6 @@ function supervisorOpts(configDir: string, path: string, o: SupervisorArmOpts) {
     installSourceDeps: STUB_INSTALL_SOURCE,
     hubSrcDir: "/nonexistent/hub/src",
     supervisor: {
-      unitInstalled: true,
       hubUnitDeps: FAKE_HUB_UNIT_DEPS,
       queryHubUnitState: () => o.managerState,
       probeHubHealth: async () => o.hubHealthy,
@@ -224,7 +223,6 @@ describe("status — Phase 3c supervisor arm: hub row", () => {
         }),
         // Replace the query with one that throws — status must not crash.
         supervisor: {
-          unitInstalled: true,
           hubUnitDeps: FAKE_HUB_UNIT_DEPS,
           queryHubUnitState: () => {
             throw new Error("systemctl exploded");
@@ -498,72 +496,9 @@ describe("status — Phase 3c supervisor arm: module rows", () => {
   });
 });
 
-describe("status — Phase 3c discriminant", () => {
-  test("no supervisor block → detached arm (pidfile readout), supervisor seams untouched", async () => {
-    const { path, configDir, cleanup } = makeTempPath();
-    try {
-      upsertService(
-        { name: "parachute-vault", port: 1940, paths: ["/"], health: "/health", version: "0.6.2" },
-        path,
-      );
-      // No `supervisor` block at all → resolveStatusSupervisor returns
-      // unitInstalled:false → the detached arm. The probe (fetchImpl) runs,
-      // proving we took the pidfile/probe path, not the supervisor path.
-      let probed = false;
-      const lines: string[] = [];
-      const code = await status({
-        manifestPath: path,
-        configDir,
-        installSourceDeps: STUB_INSTALL_SOURCE,
-        hubSrcDir: "/nonexistent/hub/src",
-        fetchImpl: async () => {
-          probed = true;
-          return new Response(null, { status: 200 });
-        },
-        print: (l) => lines.push(l),
-      });
-      expect(code).toBe(0);
-      // The detached arm probes the service's /health endpoint.
-      expect(probed).toBe(true);
-      expect(lines.some((l) => l.includes("parachute-vault"))).toBe(true);
-    } finally {
-      cleanup();
-    }
-  });
-
-  test("supervisor block with unitInstalled:false → detached arm (probe runs)", async () => {
-    const { path, configDir, cleanup } = makeTempPath();
-    try {
-      upsertService(
-        { name: "parachute-vault", port: 1940, paths: ["/"], health: "/health", version: "0.6.2" },
-        path,
-      );
-      let probed = false;
-      let queried = false;
-      const code = await status({
-        manifestPath: path,
-        configDir,
-        installSourceDeps: STUB_INSTALL_SOURCE,
-        hubSrcDir: "/nonexistent/hub/src",
-        fetchImpl: async () => {
-          probed = true;
-          return new Response(null, { status: 200 });
-        },
-        supervisor: {
-          unitInstalled: false,
-          queryHubUnitState: () => {
-            queried = true;
-            return { state: "active" };
-          },
-        },
-        print: () => {},
-      });
-      expect(code).toBe(0);
-      // Detached arm: the per-service probe runs and the manager is NOT queried.
-      expect(probed).toBe(true);
-      expect(queried).toBe(false);
-    } finally {
-      cleanup();
-    }
-  });
-});
+// The "Phase 3c discriminant" block (no-supervisor / unitInstalled:false →
+// detached pidfile-probe arm) was removed in Phase 5b: the detached arm is
+// retired, so there is no discriminant — `status` always reads the platform
+// manager + supervisor. The supervisor-path readout is exercised throughout the
+// suites above; a box with no hub unit degrades gracefully (manager `no-unit` /
+// `/health` down → inactive rows), which the hub-row + module-row suites cover.