@openparachute/hub 0.7.1 → 0.7.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +13 -14
- package/package.json +1 -1
- package/src/__tests__/admin-agent-grants.test.ts +1547 -0
- package/src/__tests__/{admin-channel-token.test.ts → admin-agent-token.test.ts} +32 -32
- package/src/__tests__/admin-connections-credentials.test.ts +8 -4
- package/src/__tests__/admin-connections.test.ts +211 -57
- package/src/__tests__/admin-csrf-belt.test.ts +7 -7
- package/src/__tests__/admin-lock.test.ts +600 -0
- package/src/__tests__/admin-module-token.test.ts +36 -8
- package/src/__tests__/admin-vaults.test.ts +8 -8
- package/src/__tests__/api-modules-ops.test.ts +17 -16
- package/src/__tests__/api-modules.test.ts +35 -36
- package/src/__tests__/api-ready.test.ts +2 -2
- package/src/__tests__/clients.test.ts +91 -0
- package/src/__tests__/grants-store.test.ts +219 -0
- package/src/__tests__/hub-server.test.ts +9 -5
- package/src/__tests__/migrate.test.ts +1 -1
- package/src/__tests__/module-manifest.test.ts +11 -11
- package/src/__tests__/oauth-client.test.ts +446 -0
- package/src/__tests__/oauth-flows-store.test.ts +141 -0
- package/src/__tests__/oauth-handlers.test.ts +124 -26
- package/src/__tests__/operator-token.test.ts +2 -2
- package/src/__tests__/scope-explanations.test.ts +3 -3
- package/src/__tests__/serve-boot.test.ts +14 -14
- package/src/__tests__/serve.test.ts +26 -0
- package/src/__tests__/service-spec-discovery.test.ts +26 -18
- package/src/__tests__/services-manifest.test.ts +60 -48
- package/src/__tests__/setup-gate.test.ts +52 -3
- package/src/__tests__/setup-wizard.test.ts +86 -280
- package/src/__tests__/setup.test.ts +1 -1
- package/src/__tests__/upgrade.test.ts +276 -0
- package/src/__tests__/vault-remove.test.ts +393 -0
- package/src/admin-agent-grants.ts +1365 -0
- package/src/admin-agent-token.ts +147 -0
- package/src/admin-connections.ts +67 -50
- package/src/admin-host-admin-token.ts +14 -1
- package/src/admin-lock.ts +281 -0
- package/src/admin-module-token.ts +15 -7
- package/src/admin-vault-admin-token.ts +8 -1
- package/src/admin-vaults.ts +12 -12
- package/src/api-admin-lock.ts +335 -0
- package/src/api-modules-ops.ts +3 -2
- package/src/api-modules.ts +9 -9
- package/src/cli.ts +13 -1
- package/src/clients.ts +88 -0
- package/src/commands/install.ts +7 -0
- package/src/commands/serve-boot.ts +5 -4
- package/src/commands/serve.ts +45 -19
- package/src/commands/setup.ts +4 -3
- package/src/commands/upgrade.ts +118 -2
- package/src/commands/vault-remove.ts +361 -0
- package/src/commands/wizard.ts +4 -4
- package/src/connections-store.ts +3 -3
- package/src/grants-store.ts +272 -0
- package/src/help.ts +4 -1
- package/src/hub-server.ts +209 -27
- package/src/hub-settings.ts +23 -8
- package/src/jwt-sign.ts +5 -1
- package/src/module-manifest.ts +2 -2
- package/src/oauth-client.ts +497 -0
- package/src/oauth-flows-store.ts +163 -0
- package/src/oauth-handlers.ts +40 -13
- package/src/operator-token.ts +1 -1
- package/src/origin-check.ts +7 -2
- package/src/resource-binding.ts +4 -4
- package/src/scope-explanations.ts +3 -3
- package/src/service-spec.ts +56 -43
- package/src/setup-wizard.ts +56 -240
- package/web/ui/dist/assets/index-B5AUE359.js +61 -0
- package/web/ui/dist/assets/{index-E_9wqjEm.css → index-DR6R8EFf.css} +1 -1
- package/web/ui/dist/index.html +2 -2
- package/src/admin-channel-token.ts +0 -135
- package/web/ui/dist/assets/index-Cxtod68O.js +0 -61
package/README.md
CHANGED
|
@@ -2,7 +2,7 @@
|
|
|
2
2
|
|
|
3
3
|
`@openparachute/hub` — the local hub for the [Parachute](https://parachute.computer) ecosystem. The `parachute` binary is one of its surfaces.
|
|
4
4
|
|
|
5
|
-
The hub coordinates the modules running on your machine: it installs them, supervises them as child processes (the hub itself runs under your platform's process manager — launchd / systemd / the container runtime), exposes them over Tailscale, serves the discovery document at `/.well-known/parachute.json`, and (soon) issues OAuth tokens. Each module (vault,
|
|
5
|
+
The hub coordinates the modules running on your machine: it installs them, supervises them as child processes (the hub itself runs under your platform's process manager — launchd / systemd / the container runtime), exposes them over Tailscale, serves the discovery document at `/.well-known/parachute.json`, and (soon) issues OAuth tokens. Each module (vault, surface, scribe, …) stays a standalone package; the hub stitches them together.
|
|
6
6
|
|
|
7
7
|
> Previously published as `@openparachute/cli`. Renamed 2026-04-26 to better reflect the role — see [parachute-patterns/hub-as-issuer](https://github.com/ParachuteComputer/parachute-patterns/blob/main/patterns/hub-as-issuer.md). The `parachute` binary name is unchanged.
|
|
8
8
|
|
|
@@ -55,7 +55,7 @@ Config in `fly.toml`. CLI-first ops; bring your own `flyctl`.
|
|
|
55
55
|
|
|
56
56
|
#### Both platforms
|
|
57
57
|
|
|
58
|
-
Pre-configured with `PARACHUTE_INSTALL_CHANNEL=latest` so modules you install via the admin SPA (vault,
|
|
58
|
+
Pre-configured with `PARACHUTE_INSTALL_CHANNEL=latest` so modules you install via the admin SPA (vault, surface, scribe, runner) pull stable releases by default. Flip to `rc` in your platform's env vars for the pre-release cascade.
|
|
59
59
|
|
|
60
60
|
Operators who want env-var-driven seeding (CI, scripted deploys) can still set `PARACHUTE_INITIAL_ADMIN_USERNAME` + `PARACHUTE_INITIAL_ADMIN_PASSWORD` manually — hub honors them on both platforms.
|
|
61
61
|
|
|
@@ -292,7 +292,7 @@ Every service mounts under a path on a single canonical hostname. The root `/` i
|
|
|
292
292
|
```
|
|
293
293
|
https://parachute.<tailnet>.ts.net/ → hub (service directory)
|
|
294
294
|
https://parachute.<tailnet>.ts.net/vault/default → parachute-vault API
|
|
295
|
-
https://parachute.<tailnet>.ts.net/
|
|
295
|
+
https://parachute.<tailnet>.ts.net/surface → parachute-surface
|
|
296
296
|
https://parachute.<tailnet>.ts.net/scribe → parachute-scribe
|
|
297
297
|
https://parachute.<tailnet>.ts.net/.well-known/parachute.json ← discovery
|
|
298
298
|
```
|
|
@@ -319,14 +319,13 @@ The `/.well-known/parachute.json` document is an always-present descriptor — f
|
|
|
319
319
|
"infoUrl": "https://parachute.taildf9ce2.ts.net/vault/default/.parachute/info"
|
|
320
320
|
},
|
|
321
321
|
{
|
|
322
|
-
"name": "parachute-
|
|
323
|
-
"url": "https://parachute.taildf9ce2.ts.net/
|
|
324
|
-
"path": "/
|
|
325
|
-
"version": "0.
|
|
326
|
-
"infoUrl": "https://parachute.taildf9ce2.ts.net/
|
|
322
|
+
"name": "parachute-surface",
|
|
323
|
+
"url": "https://parachute.taildf9ce2.ts.net/surface",
|
|
324
|
+
"path": "/surface",
|
|
325
|
+
"version": "0.3.2",
|
|
326
|
+
"infoUrl": "https://parachute.taildf9ce2.ts.net/surface/.parachute/info"
|
|
327
327
|
}
|
|
328
|
-
]
|
|
329
|
-
"lens": { "url": "https://parachute.taildf9ce2.ts.net/lens", "version": "0.0.1" }
|
|
328
|
+
]
|
|
330
329
|
}
|
|
331
330
|
```
|
|
332
331
|
|
|
@@ -343,12 +342,12 @@ Parachute services reserve a block of loopback ports in the canonical range **19
|
|
|
343
342
|
| ---- | ------------------ |
|
|
344
343
|
| 1939 | parachute-hub (internal proxy + static) |
|
|
345
344
|
| 1940 | parachute-vault |
|
|
346
|
-
| 1941 | parachute-channel
|
|
347
|
-
| 1942 | parachute-notes
|
|
345
|
+
| 1941 | parachute-agent *(renamed from parachute-channel 2026-06-17)* |
|
|
346
|
+
| 1942 | *parachute-notes (archived 2026-05-24 — notes-daemon retired; Notes now bundled in parachute-surface. Slot reclaimable; see [`parachute-notes/DEPRECATED.md`](https://github.com/ParachuteComputer/parachute-notes/blob/main/DEPRECATED.md))* |
|
|
348
347
|
| 1943 | parachute-scribe |
|
|
349
|
-
| 1944 | *parachute-agent (retired 2026-05-20; slot held —
|
|
348
|
+
| 1944 | *parachute-agent-legacy (the Claude-in-containers module retired 2026-05-20; slot held — NOT the 1941 agent module, which is the renamed channel)* |
|
|
350
349
|
| 1945 | parachute-runner *(shipped; exploration-tier, not committed-core)* |
|
|
351
|
-
| 1946 | parachute-
|
|
350
|
+
| 1946 | parachute-surface *(committed core; UI host — bundles Notes, hosts custom surfaces)* |
|
|
352
351
|
| 1947–1949 | *unassigned (CLI fallback range)* |
|
|
353
352
|
|
|
354
353
|
The hub pins 1939 — no fallback. If something else is on 1939 when you run `parachute expose`, the command fails with a pointer to `lsof -iTCP:1939` rather than walking up into another service's slot.
|
package/package.json
CHANGED