@openparachute/hub 0.6.3 → 0.6.4-rc.10

package/src/__tests__/supervisor.test.ts

@@ -178,6 +178,203 @@ describe("Supervisor.start + status transitions", () => {
   });
 });
 
+describe("Supervisor port-squatter detection (#580 item 4)", () => {
+  test("foreign pid on the module port → port_squatter error, no spawn", async () => {
+    const spawner = makeQueueSpawner();
+    // Note: NOTHING enqueued — if `start` tried to spawn, the spawner throws.
+    const sup = new Supervisor({
+      spawnFn: spawner.spawn,
+      killFn: noopKill,
+      // A rogue pid 1921 holds :1940; it is NOT one of our children.
+      pidOnPort: (port) => (port === 1940 ? 1921 : undefined),
+      ownerOfPid: (pid) => (pid === 1921 ? "bun /x/vault/src/server.ts" : undefined),
+    });
+
+    const state = await sup.start({
+      short: "vault",
+      cmd: ["bun", "vault.ts"],
+      env: { PORT: "1940" },
+    });
+
+    // No spawn attempted (spawner.calls empty), module is `crashed` with the
+    // structured, actionable squatter error.
+    expect(spawner.calls).toHaveLength(0);
+    expect(state.status).toBe("crashed");
+    expect(state.pid).toBeUndefined();
+    expect(state.startError?.error_type).toBe("port_squatter");
+    expect(state.startError?.error_description).toContain("port 1940 is held by pid 1921");
+    expect(state.startError?.error_description).toContain("bun /x/vault/src/server.ts");
+    expect(state.startError?.error_description).toContain("kill 1921 && parachute start vault");
+  });
+
+  test("squatter message omits cmdline when ownerOfPid can't read it", async () => {
+    const spawner = makeQueueSpawner();
+    const sup = new Supervisor({
+      spawnFn: spawner.spawn,
+      killFn: noopKill,
+      pidOnPort: () => 4242,
+      ownerOfPid: () => undefined,
+    });
+
+    const state = await sup.start({
+      short: "vault",
+      cmd: ["bun", "vault.ts"],
+      env: { PORT: "1940" },
+    });
+    expect(state.startError?.error_type).toBe("port_squatter");
+    expect(state.startError?.error_description).toContain("port 1940 is held by pid 4242");
+    expect(state.startError?.error_description).toContain("kill 4242 && parachute start vault");
+    // No parenthetical cmdline.
+    expect(state.startError?.error_description).not.toContain("(");
+  });
+
+  test("free port → no squatter error, module spawns normally", async () => {
+    const proc = makeFakeProc(500);
+    const spawner = makeQueueSpawner();
+    spawner.enqueue(proc);
+    const sup = new Supervisor({
+      spawnFn: spawner.spawn,
+      killFn: noopKill,
+      pidOnPort: () => undefined, // port free / detection unavailable
+    });
+
+    const state = await sup.start({
+      short: "vault",
+      cmd: ["bun", "vault.ts"],
+      env: { PORT: "1940" },
+    });
+    expect(spawner.calls).toHaveLength(1);
+    expect(state.status).toBe("running");
+    expect(state.startError).toBeUndefined();
+
+    proc.closeStreams();
+    sup.stop("vault");
+    proc.resolveExit(0);
+  });
+
+  test("port held by one of OUR OWN children is not a squatter", async () => {
+    // vault is up on pid 700 holding :1940; starting a sibling (scribe) that
+    // somehow reports the same holder pid must NOT be flagged — the holder is
+    // a supervised child, not a foreign rogue.
+    const vaultProc = makeFakeProc(700);
+    const scribeProc = makeFakeProc(701);
+    const spawner = makeQueueSpawner();
+    spawner.enqueue(vaultProc);
+    spawner.enqueue(scribeProc);
+    const sup = new Supervisor({
+      spawnFn: spawner.spawn,
+      killFn: noopKill,
+      // vault's port (1940) is free so vault spawns (pid 700). scribe's port
+      // (1943) then reports vault's pid 700 as the holder — a supervised child,
+      // NOT a foreign rogue, so scribe must still spawn.
+      pidOnPort: (port) => (port === 1943 ? 700 : undefined),
+    });
+
+    await sup.start({ short: "vault", cmd: ["bun", "vault.ts"], env: { PORT: "1940" } });
+    const scribe = await sup.start({
+      short: "scribe",
+      cmd: ["bun", "scribe.ts"],
+      env: { PORT: "1943" },
+    });
+    // scribe spawned (no false-positive squatter); both children spawned.
+    expect(spawner.calls).toHaveLength(2);
+    expect(scribe.status).toBe("running");
+    expect(scribe.startError).toBeUndefined();
+
+    vaultProc.closeStreams();
+    scribeProc.closeStreams();
+    sup.stop("vault");
+    sup.stop("scribe");
+    vaultProc.resolveExit(0);
+    scribeProc.resolveExit(0);
+  });
+
+  test("a CRASHED child's stale pid does NOT vouch for a port holder (N1 liveness)", async () => {
+    // vault spawns (pid 800), then crashes for good (maxRestarts: 1). Its entry
+    // keeps `proc.pid === 800` (never cleared on exit) but status is `crashed`.
+    // A fresh `start` where pid 800 now holds :1940 must be flagged as a
+    // SQUATTER — the stale pid of a dead child must not excuse the holder.
+    const first = makeFakeProc(800);
+    const spawner = makeQueueSpawner();
+    spawner.enqueue(first);
+    let portHeld = false;
+    const sup = new Supervisor({
+      spawnFn: spawner.spawn,
+      killFn: noopKill,
+      maxRestarts: 1,
+      restartDelayMs: 0,
+      sleep: () => Promise.resolve(),
+      // Free before the crash; pid 800 "holds" :1940 after we flip portHeld.
+      pidOnPort: (port) => (portHeld && port === 1940 ? 800 : undefined),
+      ownerOfPid: () => "bun /x/vault/src/server.ts",
+    });
+
+    await sup.start({ short: "vault", cmd: ["bun", "vault.ts"], env: { PORT: "1940" } });
+    // Crash past the budget → status `crashed`, entry.proc.pid still 800.
+    first.closeStreams();
+    first.resolveExit(1);
+    await tick();
+    expect(sup.get("vault")?.status).toBe("crashed");
+
+    // Now pid 800 holds the port. A re-start must NOT treat 800 as "ours".
+    portHeld = true;
+    const restarted = await sup.start({
+      short: "vault",
+      cmd: ["bun", "vault.ts"],
+      env: { PORT: "1940" },
+    });
+    expect(restarted.status).toBe("crashed");
+    expect(restarted.startError?.error_type).toBe("port_squatter");
+    expect(restarted.startError?.error_description).toContain("port 1940 is held by pid 800");
+    // No second spawn — the squatter check aborted before re-spawning.
+    expect(spawner.calls).toHaveLength(1);
+  });
+
+  test("no declared PORT → squatter check skipped (request without env.PORT)", async () => {
+    const proc = makeFakeProc(900);
+    const spawner = makeQueueSpawner();
+    spawner.enqueue(proc);
+    let probed = false;
+    const sup = new Supervisor({
+      spawnFn: spawner.spawn,
+      killFn: noopKill,
+      pidOnPort: () => {
+        probed = true;
+        return 1;
+      },
+    });
+
+    const state = await sup.start({ short: "vault", cmd: ["bun", "vault.ts"] });
+    // No PORT in the request → we never probe a port, and the module spawns.
+    expect(probed).toBe(false);
+    expect(state.status).toBe("running");
+
+    proc.closeStreams();
+    sup.stop("vault");
+    proc.resolveExit(0);
+  });
+
+  test("stub-spawner path defaults to no squatter (existing fake-proc tests unaffected)", async () => {
+    const proc = makeFakeProc(123);
+    const spawner = makeQueueSpawner();
+    spawner.enqueue(proc);
+    // No pidOnPort injected → on the stub-spawner (test) path it defaults to
+    // "no squatter", so a request carrying a PORT still spawns.
+    const sup = new Supervisor({ spawnFn: spawner.spawn, killFn: noopKill });
+    const state = await sup.start({
+      short: "vault",
+      cmd: ["bun", "vault.ts"],
+      env: { PORT: "1940" },
+    });
+    expect(spawner.calls).toHaveLength(1);
+    expect(state.status).toBe("running");
+
+    proc.closeStreams();
+    sup.stop("vault");
+    proc.resolveExit(0);
+  });
+});
+
 describe("Supervisor restart-on-crash", () => {
   test("restarts a crashed module within the budget", async () => {
     const first = makeFakeProc(101);
@@ -595,6 +792,113 @@ describe("Supervisor.restart", () => {
     sup.stop("vault");
     second.resolveExit(0);
   });
+
+  test("replays entry.req when no nextReq is supplied", async () => {
+    const first = makeFakeProc(101);
+    const second = makeFakeProc(102);
+    const spawner = makeQueueSpawner();
+    spawner.enqueue(first);
+    spawner.enqueue(second);
+
+    const sup = new Supervisor({
+      spawnFn: spawner.spawn,
+      killFn: noopKill,
+      restartDelayMs: 0,
+      sleep: () => Promise.resolve(),
+    });
+    await sup.start({
+      short: "vault",
+      cmd: ["bun", "vault.ts"],
+      env: { PARACHUTE_HUB_ORIGIN: "https://origin.example" },
+    });
+
+    const restartPromise = sup.restart("vault");
+    first.closeStreams();
+    first.resolveExit(0);
+    await restartPromise;
+
+    // No nextReq → the re-spawn replays the original env (legacy behavior).
+    expect(spawner.calls[1]?.env?.PARACHUTE_HUB_ORIGIN).toBe("https://origin.example");
+    expect(spawner.calls[1]?.cmd).toEqual(["bun", "vault.ts"]);
+
+    second.closeStreams();
+    sup.stop("vault");
+    second.resolveExit(0);
+  });
+
+  test("nextReq re-spawns with the refreshed req AND propagates to crash-restart (hub#532)", async () => {
+    const first = makeFakeProc(101);
+    const second = makeFakeProc(102); // restart re-spawn
+    const third = makeFakeProc(103); // crash-restart respawn
+    const spawner = makeQueueSpawner();
+    spawner.enqueue(first);
+    spawner.enqueue(second);
+    spawner.enqueue(third);
+
+    const sup = new Supervisor({
+      spawnFn: spawner.spawn,
+      killFn: noopKill,
+      restartDelayMs: 0,
+      sleep: () => Promise.resolve(),
+    });
+    // First start with the OLD origin.
+    await sup.start({
+      short: "vault",
+      cmd: ["bun", "vault.ts"],
+      env: { PARACHUTE_HUB_ORIGIN: "https://old.example" },
+    });
+
+    // Restart WITH a refreshed req carrying the NEW origin.
+    const restartPromise = sup.restart("vault", {
+      short: "vault",
+      cmd: ["bun", "vault.ts"],
+      env: { PARACHUTE_HUB_ORIGIN: "https://new.example" },
+    });
+    first.closeStreams();
+    first.resolveExit(0);
+    await restartPromise;
+
+    // The restart re-spawn carries the NEW origin.
+    expect(spawner.calls[1]?.env?.PARACHUTE_HUB_ORIGIN).toBe("https://new.example");
+
+    // Now crash the restart-spawned child (resolveExit with a non-stop code).
+    // handleExit → spawnAndWatch replays entry.req, which `start` stored from
+    // the refreshed nextReq — so the crash-restart ALSO carries the new origin.
+    second.closeStreams();
+    second.resolveExit(1);
+    await tick(20);
+
+    expect(spawner.calls).toHaveLength(3);
+    expect(spawner.calls[2]?.env?.PARACHUTE_HUB_ORIGIN).toBe("https://new.example");
+
+    third.closeStreams();
+    sup.stop("vault");
+    third.resolveExit(0);
+  });
+
+  test("throws when nextReq.short mismatches the restarted short (state-corruption guard)", async () => {
+    const proc = makeFakeProc(101);
+    const spawner = makeQueueSpawner();
+    spawner.enqueue(proc);
+    const sup = new Supervisor({
+      spawnFn: spawner.spawn,
+      killFn: noopKill,
+      restartDelayMs: 0,
+      sleep: () => Promise.resolve(),
+    });
+    await sup.start({ short: "vault", cmd: ["bun", "vault.ts"] });
+
+    // A nextReq for a DIFFERENT short would re-register under the wrong map key.
+    await expect(
+      sup.restart("vault", { short: "scribe", cmd: ["bun", "scribe.ts"] }),
+    ).rejects.toThrow(/nextReq\.short is "scribe"/);
+    // The original entry is untouched — no spurious stop/respawn happened.
+    expect(spawner.calls).toHaveLength(1);
+
+    proc.closeStreams();
+    sup.stop("vault");
+    proc.resolveExit(0);
+  });
 });
 
 describe("Supervisor output multiplexing", () => {
@@ -833,6 +1137,76 @@ describe("Supervisor port-readiness + structured start-error (§6.5)", () => {
     proc.resolveExit(0);
   });
 
+  test("(b2) late bind AFTER the window → the background watch clears the started-but-unbound note", async () => {
+    // Heavy modules (vault — SQLite + git mirror + well-known init) routinely
+    // bind a moment after the readiness window. Pre-fix, the note recorded at
+    // window-elapse stuck for the module's whole lifetime and `parachute
+    // status` showed a perpetual "failed to start" on a healthy module.
+    const proc = makeFakeProc(103);
+    const spawner = makeQueueSpawner();
+    spawner.enqueue(proc);
+    let bound = false;
+    const sup = new Supervisor({
+      spawnFn: spawner.spawn,
+      killFn: noopKill,
+      portListening: async () => bound,
+      startReadyMs: 30,
+      startReadyPollMs: 5,
+      lateBindWatchMs: 2_000,
+      lateBindPollMs: 5,
+      sleep: () => Promise.resolve(),
+    });
+    const state = await sup.start(reqWithPort("vault", 1940));
+    // Window elapsed unbound → note recorded (status stays running)…
+    expect(state.startError?.error_type).toBe("started_but_unbound");
+
+    // …then the port binds late. The watch must clear the note.
+    bound = true;
+    let cleared = false;
+    const deadline = Date.now() + 1_500;
+    while (Date.now() < deadline) {
+      if (sup.list()[0]?.startError === undefined) {
+        cleared = true;
+        break;
+      }
+      await new Promise((r) => setTimeout(r, 10));
+    }
+    expect(cleared).toBe(true);
+    expect(sup.list()[0]?.status).toBe("running");
+
+    proc.closeStreams();
+    sup.stop("vault");
+    proc.resolveExit(0);
+  });
+
+  test("(b3) never binds → the watch gives up at its deadline and the note persists", async () => {
+    // A genuinely-unbound module must KEEP its diagnostic — the watch is a
+    // bounded grace window, not an eraser.
+    const proc = makeFakeProc(104);
+    const spawner = makeQueueSpawner();
+    spawner.enqueue(proc);
+    const sup = new Supervisor({
+      spawnFn: spawner.spawn,
+      killFn: noopKill,
+      portListening: async () => false,
+      startReadyMs: 20,
+      startReadyPollMs: 5,
+      lateBindWatchMs: 40,
+      lateBindPollMs: 5,
+      sleep: () => Promise.resolve(),
+    });
+    const state = await sup.start(reqWithPort("vault", 1940));
+    expect(state.startError?.error_type).toBe("started_but_unbound");
+
+    // Let the 40ms watch budget expire; the note must remain.
+    await new Promise((r) => setTimeout(r, 120));
+    expect(sup.list()[0]?.startError?.error_type).toBe("started_but_unbound");
+
+    proc.closeStreams();
+    sup.stop("vault");
+    proc.resolveExit(0);
+  });
+
   test("(c) preflight MissingDependencyError → structured start-error, NO spawn", async () => {
     const spawner = makeQueueSpawner();
     // No proc enqueued — if start() tried to spawn, the queue spawner throws.

package/src/__tests__/users.test.ts

@@ -4,6 +4,7 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { hubDbPath, openHubDb } from "../hub-db.ts";
 import { recordTokenMint, signAccessToken } from "../jwt-sign.ts";
+import { createSession, findSession } from "../sessions.ts";
 import {
   PASSWORD_MIN_LEN,
   SingleUserModeError,
@@ -303,6 +304,45 @@ describe("deleteUser", () => {
       cleanup();
     }
   });
+
+  test("deletes a user holding an auth_codes row (hub#559 — OAuth-authorize FK regression)", async () => {
+    // A user who completed an OAuth authorize has an `auth_codes` row whose
+    // NOT-NULL, non-cascading FK to users(id) outlives its 60s TTL. Before the
+    // fix, that pinned the FK and `DELETE FROM users` threw
+    // SQLITE_CONSTRAINT_FOREIGNKEY → a 500 on the admin "delete user" action.
+    const { db, cleanup } = makeDb();
+    try {
+      const u = await createUser(db, "ag", "ag-strong-passphrase");
+      // auth_codes.client_id FKs to clients — seed a minimal client first.
+      db.prepare(
+        "INSERT INTO clients (client_id, redirect_uris, scopes, registered_at) VALUES (?, ?, ?, ?)",
+      ).run("client-x", "https://app.example/cb", "vault:default:read", "2026-06-04T00:00:00.000Z");
+      db.prepare(
+        `INSERT INTO auth_codes
+           (code, client_id, user_id, redirect_uri, scopes, code_challenge, code_challenge_method, expires_at, used_at, created_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+      ).run(
+        "dead-code",
+        "client-x",
+        u.id,
+        "https://app.example/cb",
+        "vault:default:read",
+        "challenge",
+        "S256",
+        "2026-06-04T00:00:00.000Z", // long-expired
+        "2026-06-04T00:00:00.000Z", // already used
+        "2026-06-04T00:00:00.000Z",
+      );
+      expect(deleteUser(db, u.id)).toBe(true);
+      expect(getUserById(db, u.id)).toBeNull();
+      // The dead auth_code is gone too (hard-deleted with the user).
+      expect(db.query("SELECT COUNT(*) c FROM auth_codes WHERE user_id = ?").get(u.id)).toEqual({
+        c: 0,
+      });
+    } finally {
+      cleanup();
+    }
+  });
 });
 
 describe("validateUsername", () => {
@@ -499,6 +539,32 @@ describe("resetUserPassword", () => {
     }
   });
 
+  // Item G — a reset also kills active sessions (not just tokens), so the
+  // attacker/holder of a live session cookie must re-authenticate.
+  test("deletes the user's active sessions (item G)", async () => {
+    const { db, cleanup } = makeDb();
+    try {
+      const alice = await createUser(db, "alice", "alice-strong-passphrase", {
+        passwordChanged: true,
+      });
+      const bob = await createUser(db, "bob", "bob-strong-passphrase", {
+        passwordChanged: true,
+        allowMulti: true,
+      });
+      const aliceSession = createSession(db, { userId: alice.id });
+      const bobSession = createSession(db, { userId: bob.id });
+      expect(findSession(db, aliceSession.id)).not.toBeNull();
+
+      expect(await resetUserPassword(db, alice.id, "new-temp-passphrase")).toBe(true);
+
+      // Alice's session is gone; Bob's (a different user) is untouched.
+      expect(findSession(db, aliceSession.id)).toBeNull();
+      expect(findSession(db, bobSession.id)).not.toBeNull();
+    } finally {
+      cleanup();
+    }
+  });
+
   test("does not re-revoke an already-revoked token", async () => {
     // Defense-in-depth: a previously-revoked token shouldn't have its
     // revoked_at timestamp overwritten by a fresh reset. The UPDATE's

package/src/__tests__/well-known.test.ts

@@ -123,6 +123,31 @@ describe("buildWellKnown", () => {
     ]);
   });
 
+  test("SEED placeholder vault entry is NOT fabricated into a vault row (hub#577)", () => {
+    // `parachute init` installs the vault MODULE without creating an instance,
+    // seeding a services.json entry at version "0.0.0-linked" with the
+    // canonical /vault/default mount. That must NOT surface as a phantom
+    // `default` vault in the management page.
+    const seed: ServiceEntry = { ...vault, version: "0.0.0-linked" };
+    const doc = buildWellKnown({
+      services: [seed],
+      canonicalOrigin: "https://x.example",
+    });
+    // No phantom vault row...
+    expect(doc.vaults).toEqual([]);
+    // ...but the services entry stays so the SPA knows the module IS installed
+    // (offers "New vault", not "Install module").
+    expect(doc.services.map((s) => s.name)).toEqual(["parachute-vault"]);
+  });
+
+  test("a REAL (non-seed) vault entry still lands in vaults[] (hub#577 regression guard)", () => {
+    const doc = buildWellKnown({
+      services: [{ ...vault, version: "0.5.1", paths: ["/vault/techne"] }],
+      canonicalOrigin: "https://x.example",
+    });
+    expect(doc.vaults.map((v) => v.name)).toEqual(["techne"]);
+  });
+
   test("multiple installs of the same kind both land in the array (#92)", () => {
     const work: ServiceEntry = { ...notes, paths: ["/notes-work"], port: 5174 };
     const doc = buildWellKnown({

package/src/__tests__/wizard.test.ts

@@ -32,6 +32,12 @@ interface FakeHubState {
   importParams?: { remoteUrl: string; pat?: string; mode: string };
   exposeMode?: string;
   posted: Array<{ path: string; body: unknown }>;
+  /** hub#576: when set, the fake GET /admin/setup reports requireBootstrapToken=true. */
+  requireBootstrapToken?: boolean;
+  /** hub#576: when set, the fake GET also returns it (loopback-probe behavior). */
+  bootstrapToken?: string;
+  /** hub#576: when true, the account POST 401s unless the right token is supplied. */
+  enforceBootstrapToken?: boolean;
 }
 
 function makeFakeHub(initialState?: Partial<FakeHubState>): {
@@ -86,8 +92,10 @@ function makeFakeHub(initialState?: Partial<FakeHubState>): {
         hasAdmin: state.hasAdmin,
         hasVault: state.hasVault,
         hasExposeMode: state.hasExposeMode,
-        requireBootstrapToken: false,
+        requireBootstrapToken: state.requireBootstrapToken ?? false,
         csrfToken: csrf,
+        // hub#576: a loopback probe carries the actual token value.
+        ...(state.bootstrapToken ? { bootstrapToken: state.bootstrapToken } : {}),
       });
       return new Response(respBody, {
         status: 200,
@@ -101,6 +109,17 @@ function makeFakeHub(initialState?: Partial<FakeHubState>): {
     // POST /admin/setup/account
     if (path === "/admin/setup/account" && method === "POST") {
       state.posted.push({ path, body: bodyJson });
+      // hub#576: reject when the gate is enforced and the supplied token is
+      // wrong / missing — proves the CLI wizard actually sends it.
+      if (state.enforceBootstrapToken) {
+        const supplied = (bodyJson as { bootstrap_token?: string })?.bootstrap_token;
+        if (supplied !== state.bootstrapToken) {
+          return new Response(JSON.stringify({ error: "bad bootstrap token" }), {
+            status: 401,
+            headers: { "content-type": "application/json; charset=utf-8" },
+          });
+        }
+      }
       state.hasAdmin = true;
       return new Response(JSON.stringify({ step: "vault", message: "admin created" }), {
         status: 200,
@@ -270,6 +289,58 @@ describe("runCliWizard", () => {
     expect(state.exposeMode).toBe("localhost");
   });
 
+  test("loopback-probe bootstrap token is sent transparently (no prompt) — hub#576", async () => {
+    const { state, fetchImpl } = makeFakeHub({
+      requireBootstrapToken: true,
+      bootstrapToken: "parachute-bootstrap-LOOPBACK",
+      enforceBootstrapToken: true,
+    });
+    let prompted = false;
+    const code = await runCliWizard({
+      hubUrl: "http://127.0.0.1:1939",
+      log: () => {},
+      fetchImpl,
+      sleep: async () => {},
+      // No --bootstrap-token flag, no env: the value must come from the probe.
+      prompt: async () => {
+        prompted = true;
+        return "";
+      },
+      accountUsername: "admin",
+      accountPassword: "longpassword",
+      vaultMode: "skip",
+      exposeMode: "localhost",
+    });
+    expect(code).toBe(0);
+    // The account POST carried the probe-supplied token...
+    const accountBody = state.posted[0]?.body as Record<string, string>;
+    expect(accountBody.bootstrap_token).toBe("parachute-bootstrap-LOOPBACK");
+    // ...and the operator was never asked for it.
+    expect(prompted).toBe(false);
+  });
+
+  test("explicit --bootstrap-token flag still wins over the probe value — hub#576", async () => {
+    const { state, fetchImpl } = makeFakeHub({
+      requireBootstrapToken: true,
+      bootstrapToken: "parachute-bootstrap-PROBE",
+      enforceBootstrapToken: false,
+    });
+    const code = await runCliWizard({
+      hubUrl: "http://127.0.0.1:1939",
+      log: () => {},
+      fetchImpl,
+      sleep: async () => {},
+      bootstrapToken: "parachute-bootstrap-EXPLICIT",
+      accountUsername: "admin",
+      accountPassword: "longpassword",
+      vaultMode: "skip",
+      exposeMode: "localhost",
+    });
+    expect(code).toBe(0);
+    const accountBody = state.posted[0]?.body as Record<string, string>;
+    expect(accountBody.bootstrap_token).toBe("parachute-bootstrap-EXPLICIT");
+  });
+
   test("vault import mode threads remote_url + pat + import_mode", async () => {
     const { state, fetchImpl } = makeFakeHub();
     const code = await runCliWizard({