@openparachute/hub 0.7.0 → 0.7.2-rc.1

package/src/__tests__/admin-vaults.test.ts

@@ -735,7 +735,7 @@ import { findTokenRowByJti, listActiveRevocations, recordTokenMint } from "../jw
 import { createUser, setUserVaults } from "../users.ts";
 
 const VAULT_ORIGIN = "http://127.0.0.1:19400";
-const CHANNEL_ORIGIN = "http://127.0.0.1:19410";
+const AGENT_ORIGIN = "http://127.0.0.1:19410";
 
 /** Successful no-op runner — records the commands it was asked to run. */
 function stubRun(
@@ -788,7 +788,7 @@ interface DeleteCallOpts {
   connectionsStorePath: string;
   runCommand?: (cmd: readonly string[]) => Promise<RunResult>;
   restartVaultModule?: () => Promise<void>;
-  channelOrigin?: string | null;
+  agentOrigin?: string | null;
   fetchImpl?: typeof fetch;
   resolveVaultOrigin?: (v: string) => string | null;
 }
@@ -810,7 +810,7 @@ async function callDelete(opts: DeleteCallOpts): Promise<Response> {
     issuer: ISSUER,
     manifestPath: opts.manifestPath,
     connectionsStorePath: opts.connectionsStorePath,
-    channelOrigin: opts.channelOrigin ?? null,
+    agentOrigin: opts.agentOrigin ?? null,
     resolveVaultOrigin: opts.resolveVaultOrigin ?? (() => VAULT_ORIGIN),
     runCommand: opts.runCommand ?? stubRun().run,
     ...(opts.restartVaultModule ? { restartVaultModule: opts.restartVaultModule } : {}),
@@ -1002,7 +1002,7 @@ describe("DELETE /vaults/<name> — the identity cascade", () => {
         // 1. Registry rows: two naming "work" (one standalone + the
         //    connection's registered mint below), one naming "default".
         registryRow(db, "jti-work-1", ["vault:work:write"]);
-        registryRow(db, "jti-conn-1", ["channel:send"]); // connection webhook bearer (non-vault scope)
+        registryRow(db, "jti-conn-1", ["agent:send"]); // connection webhook bearer (non-vault scope)
         registryRow(db, "jti-default-1", ["vault:default:read"]);
 
         // 2. Grants: one spanning both vaults (rewrite), one work-only (drop).
@@ -1036,7 +1036,7 @@ describe("DELETE /vaults/<name> — the identity cascade", () => {
         putConnection(store, {
           id: "conn-work",
           source: { module: "vault", vault: "work", event: "note.created" },
-          sink: { module: "channel", action: "message.deliver", params: { channel: "eng" } },
+          sink: { module: "agent", action: "message.deliver", params: { channel: "eng" } },
           provisioned: {
             type: "vault-trigger",
             vault: "work",
@@ -1048,7 +1048,7 @@ describe("DELETE /vaults/<name> — the identity cascade", () => {
         putConnection(store, {
           id: "conn-default",
           source: { module: "vault", vault: "default", event: "note.created" },
-          sink: { module: "channel", action: "message.deliver", params: { channel: "ops" } },
+          sink: { module: "agent", action: "message.deliver", params: { channel: "ops" } },
           provisioned: { type: "vault-trigger", vault: "default", triggerName: "conn_d" },
           createdAt: new Date().toISOString(),
         });
@@ -1078,7 +1078,7 @@ describe("DELETE /vaults/<name> — the identity cascade", () => {
           restartVaultModule: async () => {
             restarted = true;
           },
-          channelOrigin: CHANNEL_ORIGIN,
+          agentOrigin: AGENT_ORIGIN,
           fetchImpl,
           resolveVaultOrigin: (v) => (v === "work" ? VAULT_ORIGIN : null),
         });
@@ -1102,7 +1102,7 @@ describe("DELETE /vaults/<name> — the identity cascade", () => {
         expect(out.name).toBe("work");
 
         // 1. Registry sweep: the work-scoped row revoked; default untouched.
-        //    The connection's webhook-bearer row (channel:send — names no
+        //    The connection's webhook-bearer row (agent:send — names no
         //    vault) is revoked by the CONNECTION teardown, not the sweep.
         expect(out.cascade.tokens_revoked).toBe(1);
         expect(findTokenRowByJti(db, "jti-work-1")?.revokedAt).not.toBeNull();

package/src/__tests__/api-invites.test.ts

@@ -68,6 +68,24 @@ function deps() {
   return { db: harness.db, issuer: ISSUER, manifestPath: harness.manifestPath };
 }
 
+/** Register an existing vault in the harness manifest (for shared-vault invites). */
+function seedVaultInManifest(name: string) {
+  writeFileSync(
+    harness.manifestPath,
+    JSON.stringify({
+      services: [
+        {
+          name: "parachute-vault",
+          port: 4101,
+          paths: [`/vault/${name}`],
+          health: "/health",
+          version: "0.0.0-test",
+        },
+      ],
+    }),
+  );
+}
+
 function withBearer(path: string, bearer: string, init: RequestInit = {}): Request {
   const headers = new Headers(init.headers ?? {});
   headers.set("authorization", `Bearer ${bearer}`);
@@ -121,23 +139,64 @@ describe("POST /api/invites", () => {
     expect(res.status).toBe(400);
   });
 
-  test("400 rejects a shared-vault invite (provision_vault=false + vault_name)", async () => {
-    // Defense in depth (FIX-1): assigning a redeemer to a PRE-EXISTING vault
-    // as owner-admin is a cross-tenant breach; shared-vault invites aren't
-    // supported yet, so the create handler refuses this combination outright.
+  test("shared-vault invite (provision_vault=false + EXISTING vault_name) → 201 at the given role", async () => {
+    // The Adam/Jonathan shape: read-only access to a vault the admin already
+    // built. Issuing is host:admin-gated — the same authority that can assign
+    // any user to any vault via POST /api/users.
+    seedVaultInManifest("jonathan-vault");
     const bearer = await makeAdminBearer();
     const res = await handleCreateInvite(
       withBearer("/api/invites", bearer, {
         method: "POST",
         headers: { "content-type": "application/json" },
-        body: JSON.stringify({ provision_vault: false, vault_name: "someoneelse" }),
+        body: JSON.stringify({
+          provision_vault: false,
+          vault_name: "jonathan-vault",
+          role: "read",
+        }),
+      }),
+      deps(),
+    );
+    expect(res.status).toBe(201);
+    const body = (await res.json()) as {
+      invite: { vault_name: string | null; role: string; provision_vault: boolean };
+    };
+    expect(body.invite.vault_name).toBe("jonathan-vault");
+    expect(body.invite.role).toBe("read");
+    expect(body.invite.provision_vault).toBe(false);
+  });
+
+  test("400 vault_not_found when the shared vault doesn't exist on this hub", async () => {
+    // A pinned-but-nonexistent name is a typo, not a future reservation —
+    // fail at mint, not at the invitee's redeem.
+    const bearer = await makeAdminBearer();
+    const res = await handleCreateInvite(
+      withBearer("/api/invites", bearer, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ provision_vault: false, vault_name: "nosuchvault", role: "read" }),
+      }),
+      deps(),
+    );
+    expect(res.status).toBe(400);
+    const body = (await res.json()) as { error: string };
+    expect(body.error).toBe("vault_not_found");
+  });
+
+  test("400 rejects role=read with provision_vault=true (sole user of a new vault must hold write)", async () => {
+    const bearer = await makeAdminBearer();
+    const res = await handleCreateInvite(
+      withBearer("/api/invites", bearer, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ provision_vault: true, role: "read" }),
       }),
       deps(),
     );
     expect(res.status).toBe(400);
     const body = (await res.json()) as { error: string; error_description: string };
     expect(body.error).toBe("invalid_request");
-    expect(body.error_description).toContain("shared-vault");
+    expect(body.error_description).toContain("write");
   });
 
   test("account-only invite (provision_vault=false, NO vault_name) is still allowed", async () => {
@@ -159,6 +218,107 @@ describe("POST /api/invites", () => {
   });
 });
 
+describe("POST /api/invites — pre-named username", () => {
+  test("201 carries the username in the wire shape", async () => {
+    seedVaultInManifest("jonathan-vault");
+    const bearer = await makeAdminBearer();
+    const res = await handleCreateInvite(
+      withBearer("/api/invites", bearer, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({
+          username: "jonathan",
+          provision_vault: false,
+          vault_name: "jonathan-vault",
+          role: "read",
+        }),
+      }),
+      deps(),
+    );
+    expect(res.status).toBe(201);
+    const body = (await res.json()) as { invite: { username: string | null } };
+    expect(body.invite.username).toBe("jonathan");
+  });
+
+  test("400 invalid_username on a name outside the /api/users vocabulary", async () => {
+    const bearer = await makeAdminBearer();
+    for (const bad of ["A", "Has Spaces", "admin"]) {
+      const res = await handleCreateInvite(
+        withBearer("/api/invites", bearer, {
+          method: "POST",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify({ username: bad }),
+        }),
+        deps(),
+      );
+      expect(res.status).toBe(400);
+      const body = (await res.json()) as { error: string };
+      expect(body.error).toBe("invalid_username");
+    }
+  });
+
+  test("409 username_taken when an existing user holds the name (case-insensitive)", async () => {
+    const bearer = await makeAdminBearer(); // creates user "operator"
+    const res = await handleCreateInvite(
+      withBearer("/api/invites", bearer, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ username: "operator" }),
+      }),
+      deps(),
+    );
+    expect(res.status).toBe(409);
+    const body = (await res.json()) as { error: string };
+    expect(body.error).toBe("username_taken");
+  });
+
+  test("409 username_reserved when another PENDING invite pre-names the same username", async () => {
+    const bearer = await makeAdminBearer();
+    const make = () =>
+      handleCreateInvite(
+        withBearer("/api/invites", bearer, {
+          method: "POST",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify({ username: "jonathan" }),
+        }),
+        deps(),
+      );
+    const first = await make();
+    expect(first.status).toBe(201);
+    const second = await make();
+    expect(second.status).toBe(409);
+    const body = (await second.json()) as { error: string };
+    expect(body.error).toBe("username_reserved");
+  });
+
+  test("revoking the pending invite frees the reserved username", async () => {
+    const bearer = await makeAdminBearer();
+    const first = await handleCreateInvite(
+      withBearer("/api/invites", bearer, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ username: "jonathan" }),
+      }),
+      deps(),
+    );
+    const { invite } = (await first.json()) as { invite: { id: string } };
+    await handleRevokeInvite(
+      withBearer(`/api/invites/${invite.id}`, bearer, { method: "DELETE" }),
+      invite.id,
+      deps(),
+    );
+    const second = await handleCreateInvite(
+      withBearer("/api/invites", bearer, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ username: "jonathan" }),
+      }),
+      deps(),
+    );
+    expect(second.status).toBe(201);
+  });
+});
+
 describe("GET /api/invites", () => {
   test("lists invites; raw token NEVER present in the wire shape", async () => {
     const bearer = await makeAdminBearer();

package/src/__tests__/api-modules-ops.test.ts

@@ -208,13 +208,14 @@ describe("parseModulesPath", () => {
     });
   });
 
-  test("accepts any KNOWN module short — channel install now resolves (was the bug)", () => {
+  test("accepts any KNOWN module short — agent install now resolves (was the bug)", () => {
     // Post-2026-06-09 (modular-UI architecture, P2) the install-path gate is
     // `isKnownModuleShort` (KNOWN_MODULES ∪ FIRST_PARTY_FALLBACKS), NOT the old
-    // CURATED_MODULES whitelist. channel is in FIRST_PARTY_FALLBACKS, so its
-    // install path now resolves — fixing the running-but-uninstallable bug.
-    expect(parseModulesPath("/api/modules/channel/install")).toEqual({
-      short: "channel",
+    // CURATED_MODULES whitelist. agent (renamed from channel 2026-06-17) is in
+    // KNOWN_MODULES, so its install path now resolves — fixing the
+    // running-but-uninstallable bug.
+    expect(parseModulesPath("/api/modules/agent/install")).toEqual({
+      short: "agent",
       rest: "install",
     });
     // Other known modules (runner / surface) resolve too.
@@ -1014,15 +1015,15 @@ describe("POST /api/modules/:short/start", () => {
   });
 
   test("channel#41: start reconciles a drifted services.json port back to canonical (API path)", async () => {
-    // The live signature: channel's row carried 19415 instead of canonical 1941.
-    // The API start path (admin SPA / `parachute start channel`) must apply the
-    // SAME reconcile the boot path does — otherwise an operator-triggered start
-    // re-strands the module on the dead port.
+    // The live signature: the agent (then channel) row carried 19415 instead of
+    // canonical 1941. The API start path (admin SPA / `parachute start agent`)
+    // must apply the SAME reconcile the boot path does — otherwise an
+    // operator-triggered start re-strands the module on the dead port.
     writeManifest(h.manifestPath, [
       {
-        name: "parachute-channel",
+        name: "parachute-agent",
         port: 19415,
-        paths: ["/channel"],
+        paths: ["/agent"],
         health: "/health",
         version: "0.0.0-linked",
       },
@@ -1032,8 +1033,8 @@ describe("POST /api/modules/:short/start", () => {
     const bearer = await mintBearer(h, [API_MODULES_OPS_REQUIRED_SCOPE]);
 
     const res = await handleStart(
-      postReq("/api/modules/channel/start", { authorization: `Bearer ${bearer}` }),
-      "channel",
+      postReq("/api/modules/agent/start", { authorization: `Bearer ${bearer}` }),
+      "agent",
       {
         db: h.db,
         issuer: ISSUER,
@@ -1048,14 +1049,14 @@ describe("POST /api/modules/:short/start", () => {
     // The supervisor child gets PORT=1941 (canonical), not the drifted 19415 —
     // so it binds + the readiness probe checks the right port.
     expect(spawns.length).toBe(1);
-    expect(spawns[0]?.short).toBe("channel");
+    expect(spawns[0]?.short).toBe("agent");
     expect(spawns[0]?.env?.PORT).toBe("1941");
     // services.json row is rewritten to 1941 → the reverse-proxy (which reads
-    // services.json) routes /channel/* to the live port.
+    // services.json) routes /agent/* to the live port.
     const onDisk = JSON.parse(readFileSync(h.manifestPath, "utf8")) as {
       services: { name: string; port: number }[];
     };
-    expect(onDisk.services.find((s) => s.name === "parachute-channel")?.port).toBe(1941);
+    expect(onDisk.services.find((s) => s.name === "parachute-agent")?.port).toBe(1941);
     // The reconcile event logged on the API path too (deps.log wired — #41 review).
     expect(
       logs.some((l) => l.includes("reconciled") && l.includes("19415") && l.includes("1941")),

package/src/__tests__/api-modules.test.ts

@@ -220,7 +220,7 @@ describe("GET /api/modules", () => {
     // by the UNION of the bootstrap registries (KNOWN_MODULES ∪
     // FIRST_PARTY_FALLBACKS), NOT a curated whitelist. Every known module
     // surfaces — core (vault/scribe/surface) in the headline tier, the rest
-    // (channel/runner/notes) as `experimental` — so the channel-not-installed
+    // (agent/runner/notes) as `experimental` — so the agent-not-installed
     // class (running but invisible) can't recur.
     const bearer = await mintBearer(h, [API_MODULES_REQUIRED_SCOPE]);
     const res = await handleApiModules(getReq({ authorization: `Bearer ${bearer}` }), {
@@ -244,11 +244,11 @@ describe("GET /api/modules", () => {
     // The core tier leads, in the recommended install order (vault → scribe),
     // ahead of every experimental module.
     expect(shorts.indexOf("vault")).toBeLessThan(shorts.indexOf("scribe"));
-    expect(shorts.indexOf("scribe")).toBeLessThan(shorts.indexOf("channel"));
+    expect(shorts.indexOf("scribe")).toBeLessThan(shorts.indexOf("agent"));
     expect(shorts.indexOf("scribe")).toBeLessThan(shorts.indexOf("runner"));
     // Every known module is discoverable — vault/scribe/surface (core) +
-    // channel/runner/notes (experimental).
-    for (const s of ["vault", "scribe", "surface", "channel", "runner", "notes"]) {
+    // agent/runner/notes (experimental).
+    for (const s of ["vault", "scribe", "surface", "agent", "runner", "notes"]) {
       expect(shorts).toContain(s);
     }
     // Focus tier resolves from the default map.
@@ -256,7 +256,7 @@ describe("GET /api/modules", () => {
     expect(byShort.get("vault")?.focus).toBe("core");
     expect(byShort.get("scribe")?.focus).toBe("core");
     expect(byShort.get("surface")?.focus).toBe("core");
-    expect(byShort.get("channel")?.focus).toBe("experimental");
+    expect(byShort.get("agent")?.focus).toBe("experimental");
     expect(byShort.get("runner")?.focus).toBe("experimental");
     expect(byShort.get("notes")?.focus).toBe("experimental");
     expect(body.modules.every((m) => m.available)).toBe(true);
@@ -304,24 +304,24 @@ describe("GET /api/modules", () => {
     expect(scribe?.available).toBe(true);
   });
 
-  test("channel (running + self-registered) appears as installed + experimental — regression for the channel-not-installed bug", async () => {
-    // THE bug this PR fixes (2026-06-09 modular-UI architecture, P2): channel
+  test("agent (running + self-registered) appears as installed + experimental — regression for the channel-not-installed bug", async () => {
+    // THE bug this PR fixes (2026-06-09 modular-UI architecture, P2): agent (renamed from channel 2026-06-17)
     // was running, proxied, supervised, and self-registered in services.json
     // yet invisible on the Modules screen — because the old CURATED_MODULES =
     // ["vault","scribe"] whitelist gated discovery. Now discovery is driven by
-    // self-registration ∪ the known registries, so a self-registered channel
+    // self-registration ∪ the known registries, so a self-registered agent
     // row surfaces as installed, in the experimental tier, with its run-state.
     writeManifest(h.manifestPath, [
       {
-        name: "parachute-channel",
+        name: "parachute-agent",
         port: 1941,
-        paths: ["/channel"],
-        health: "/channel/health",
+        paths: ["/agent"],
+        health: "/agent/health",
         version: "0.3.1",
       },
     ]);
     const { supervisor } = makeIdleSupervisor();
-    await supervisor.start({ short: "channel", cmd: ["parachute-channel", "daemon"] });
+    await supervisor.start({ short: "agent", cmd: ["parachute-agent"] });
 
     const bearer = await mintBearer(h, [API_MODULES_REQUIRED_SCOPE]);
     const res = await handleApiModules(getReq({ authorization: `Bearer ${bearer}` }), {
@@ -340,18 +340,17 @@ describe("GET /api/modules", () => {
         supervisor_status: string | null;
       }>;
     };
-    const channel = body.modules.find((m) => m.short === "channel");
-    expect(channel).toBeDefined();
-    expect(channel?.installed).toBe(true);
-    expect(channel?.installed_version).toBe("0.3.1");
-    expect(channel?.focus).toBe("experimental");
-    expect(channel?.supervisor_status).toBe("running");
+    const agent = body.modules.find((m) => m.short === "agent");
+    expect(agent).toBeDefined();
+    expect(agent?.installed).toBe(true);
+    expect(agent?.installed_version).toBe("0.3.1");
+    expect(agent?.focus).toBe("experimental");
+    expect(agent?.supervisor_status).toBe("running");
   });
 
   test("every self-registered + known module appears in `modules` — no running-but-invisible class", async () => {
     // The two-registry-disagreement (services.json says installed, the curated
-    // whitelist says invisible) is gone: a self-registered surface row + a
-    // supervised channel both surface in `modules` (2026-06-09 modular-UI
+    // whitelist says invisible) is gone: a self-registered surface row + a    // supervised agent both surface in `modules` (2026-06-09 modular-UI
     // architecture). `supervised` still mirrors the run-state for every
     // tracked module (hub#539) — consumers dedupe by short.
     writeManifest(h.manifestPath, [
@@ -630,19 +629,19 @@ describe("GET /api/modules", () => {
   });
 
   test("populates config_ui_url from a module's configUiUrl (2026-06-09 modular-UI P3)", async () => {
-    // Channel declares `configUiUrl: "/channel/admin"` (a single-instance,
-    // origin-absolute path) + `uiUrl: "/channel/ui"`. The hub surfaces
+    // Agent declares `configUiUrl: "/agent/admin"` (a single-instance,
+    // origin-absolute path) + `uiUrl: "/agent/ui"`. The hub surfaces
     // both: `config_ui_url` drives the Modules page Configure action,
     // `management_url` drives Open. configUiUrl resolves identically to
     // managementUrl (same B4 unified semantics).
     writeManifest(h.manifestPath, [
       {
-        name: "channel",
+        name: "agent",
         port: 1941,
-        paths: ["/channel"],
+        paths: ["/agent"],
         health: "/health",
         version: "0.1.0",
-        installDir: "/install/dir/channel",
+        installDir: "/install/dir/agent",
       },
     ]);
     const bearer = await mintBearer(h, [API_MODULES_REQUIRED_SCOPE]);
@@ -652,17 +651,17 @@ describe("GET /api/modules", () => {
       manifestPath: h.manifestPath,
       fetchLatestVersion: async () => null,
       readModuleManifest: async (installDir) => {
-        if (installDir === "/install/dir/channel") {
+        if (installDir === "/install/dir/agent") {
           return {
-            name: "channel",
-            manifestName: "parachute-channel",
-            displayName: "Channel",
+            name: "agent",
+            manifestName: "parachute-agent",
+            displayName: "Agent",
             tagline: "",
             port: 1941,
-            paths: ["/channel"],
+            paths: ["/agent"],
             health: "/health",
-            uiUrl: "/channel/ui",
-            configUiUrl: "/channel/admin",
+            uiUrl: "/agent/ui",
+            configUiUrl: "/agent/admin",
           } as unknown as Awaited<
             ReturnType<typeof import("../module-manifest.ts").readModuleManifest>
           >;
@@ -678,11 +677,11 @@ describe("GET /api/modules", () => {
         management_url: string | null;
       }>;
     };
-    const channel = body.modules.find((m) => m.short === "channel");
-    // Origin-absolute — verbatim, never double-prepends `/channel`.
-    expect(channel?.config_ui_url).toBe("/channel/admin");
+    const agent = body.modules.find((m) => m.short === "agent");
+    // Origin-absolute — verbatim, never double-prepends `/agent`.
+    expect(agent?.config_ui_url).toBe("/agent/admin");
     // uiUrl (no managementUrl) drives the Open action's management_url.
-    expect(channel?.management_url).toBe("/channel/ui");
+    expect(agent?.management_url).toBe("/agent/ui");
   });
 
   test("config_ui_url is null when the module declares no configUiUrl", async () => {

package/src/__tests__/api-ready.test.ts

@@ -92,7 +92,7 @@ describe("handleApiReady — supervisor mode", () => {
       moduleState({ short: "vault", status: "starting" }),
       moduleState({ short: "scribe", status: "restarting" }),
       moduleState({ short: "notes", status: "crashed" }),
-      moduleState({ short: "channel", status: "stopped" }),
+      moduleState({ short: "agent", status: "stopped" }),
       moduleState({
         short: "runner",
         status: "running",
@@ -109,7 +109,7 @@ describe("handleApiReady — supervisor mode", () => {
     expect(body.ready).toBe(false);
     expect(body.ready_modules).toEqual(["runner"]);
     expect(body.transient_modules.sort()).toEqual(["scribe", "vault"]);
-    expect(body.persistent_modules.sort()).toEqual(["channel", "notes"]);
+    expect(body.persistent_modules.sort()).toEqual(["agent", "notes"]);
   });
 
   test("only crashed/stopped + nothing transient → ready=false (still failing)", async () => {