@openparachute/hub 0.7.2 → 0.7.3-rc.10

package/src/__tests__/two-factor-flow.test.ts

@@ -332,6 +332,100 @@ describe("login two-step (TOTP) — hub#473", () => {
     expect(denied.status).toBe(429);
     expect(denied.headers.get("retry-after")).not.toBeNull();
   });
+
+  // Fallback path: when the pending login can't be resolved (bad/expired
+  // token), the floor keys by IP ALONE — NOT the (rotating) pendingToken.
+  // Proven here by sending a DIFFERENT bogus pending cookie on every attempt
+  // from one IP: if the floor keyed by the token each would get a fresh bucket
+  // and never 429; keying by IP, the 6th still trips.
+  test("2FA floor with unresolvable pending tokens keys by IP, not the token", async () => {
+    const buildReq = (bogusToken: string) => {
+      const tf = formBody({ [CSRF_FIELD_NAME]: TEST_CSRF, code: "000000", next: "/admin/vaults" });
+      return new Request("http://hub.test/login/2fa", {
+        method: "POST",
+        headers: {
+          ...tf.headers,
+          cookie: `${CSRF_COOKIE}; ${PENDING_LOGIN_COOKIE_NAME}=${bogusToken}`,
+          "cf-connecting-ip": "203.0.113.77",
+        },
+        body: tf.body,
+      });
+    };
+    for (let i = 0; i < 5; i++) {
+      // A unique bogus token per attempt → never resolves to a pending login.
+      const r = await handleAdminLoginTotpPost(harness.db, buildReq(`bogus-${i}`));
+      expect(r.status).toBe(401); // no pending login → 401, counts toward the IP floor
+    }
+    const denied = await handleAdminLoginTotpPost(harness.db, buildReq("bogus-final"));
+    expect(denied.status).toBe(429);
+    expect(denied.headers.get("retry-after")).not.toBeNull();
+  });
+
+  // (d) The 2FA floor is keyed by (ip,userId), NOT the rotating pendingToken.
+  // Re-POSTing /login mints a FRESH pendingToken for the SAME user — that must
+  // NOT reset the per-account TOTP floor (otherwise an attacker grinds TOTP
+  // forever by re-doing the password step between every 5 code attempts).
+  test("(d) re-POSTing /login (new pendingToken) does NOT reset the per-account TOTP floor", async () => {
+    const u = await createUser(harness.db, "owner", "owner-password-123", {
+      passwordChanged: true,
+    });
+    await persistEnrollment(harness.db, u.id, generateTotpSecret("owner").secret);
+    const ATTACK_IP = "203.0.113.66";
+
+    const passwordPost = async (): Promise<string> => {
+      const pw = formBody({
+        [CSRF_FIELD_NAME]: TEST_CSRF,
+        username: "owner",
+        password: "owner-password-123",
+        next: "/admin/vaults",
+      });
+      const res = await handleAdminLoginPost(
+        harness.db,
+        new Request("http://hub.test/login", {
+          method: "POST",
+          headers: { ...pw.headers, cookie: CSRF_COOKIE, "cf-connecting-ip": ATTACK_IP },
+          body: pw.body,
+        }),
+      );
+      const token = cookieFrom(res, PENDING_LOGIN_COOKIE_NAME);
+      expect(token).toBeTruthy();
+      return token!;
+    };
+
+    const wrongTotp = (pendingToken: string): Request => {
+      const tf = formBody({ [CSRF_FIELD_NAME]: TEST_CSRF, code: "000000", next: "/admin/vaults" });
+      return new Request("http://hub.test/login/2fa", {
+        method: "POST",
+        headers: {
+          ...tf.headers,
+          cookie: `${CSRF_COOKIE}; ${PENDING_LOGIN_COOKIE_NAME}=${pendingToken}`,
+          "cf-connecting-ip": ATTACK_IP,
+        },
+        body: tf.body,
+      });
+    };
+
+    // First password step → pendingToken1.
+    const token1 = await passwordPost();
+    // 4 wrong TOTP attempts against pendingToken1 (all 401, all count toward
+    // the (ip,userId) bucket).
+    for (let i = 0; i < 4; i++) {
+      expect((await handleAdminLoginTotpPost(harness.db, wrongTotp(token1))).status).toBe(401);
+    }
+
+    // Re-do the password step → a BRAND-NEW pendingToken2 (same userId).
+    const token2 = await passwordPost();
+    expect(token2).not.toBe(token1);
+
+    // 5th wrong TOTP — under pendingToken2 but the SAME (ip,userId) bucket →
+    // still the 5th attempt → allowed (401), not reset to fresh.
+    expect((await handleAdminLoginTotpPost(harness.db, wrongTotp(token2))).status).toBe(401);
+    // 6th wrong TOTP → floor full → 429. If the floor were keyed by the
+    // pendingToken, token2 would have a fresh bucket and this would be a 401.
+    const denied = await handleAdminLoginTotpPost(harness.db, wrongTotp(token2));
+    expect(denied.status).toBe(429);
+    expect(denied.headers.get("retry-after")).not.toBeNull();
+  });
 });
 
 describe("/account/2fa handlers — hub#473", () => {

package/src/__tests__/users.test.ts

@@ -23,6 +23,7 @@ import {
   setPassword,
   setUserVaults,
   userCount,
+  validateEmail,
   validatePassword,
   validateUsername,
   vaultVerbsForRole,
@@ -431,6 +432,38 @@ describe("validatePassword", () => {
   });
 });
 
+describe("validateEmail (v15, B2)", () => {
+  test("accepts ordinary addresses, canonicalizing to lowercase/trimmed", () => {
+    const r = validateEmail("  Alice@Example.com ");
+    expect(r.valid).toBe(true);
+    if (r.valid) expect(r.email).toBe("alice@example.com");
+    expect(validateEmail("a.b+tag@sub.domain.co.uk").valid).toBe(true);
+    expect(validateEmail("user_name@x.io").valid).toBe(true);
+  });
+
+  test("rejects malformed shapes", () => {
+    for (const bad of [
+      "",
+      "not-an-email",
+      "@example.com",
+      "alice@",
+      "alice@example",
+      "alice example@x.io",
+      "two@@x.io",
+      "alice@x.c",
+    ]) {
+      expect(validateEmail(bad).valid).toBe(false);
+    }
+  });
+
+  test("rejects over-length addresses (>254)", () => {
+    const long = `${"a".repeat(250)}@x.io`;
+    const r = validateEmail(long);
+    expect(r.valid).toBe(false);
+    if (!r.valid) expect(r.reason).toBe("length");
+  });
+});
+
 describe("resetUserPassword", () => {
   test("returns false when user does not exist", async () => {
     const { db, cleanup } = makeDb();

package/src/__tests__/vault-caps.test.ts

@@ -0,0 +1,89 @@
+/**
+ * Per-vault storage cap store (`src/vault-caps.ts`, migration v15, B4). The
+ * cap is PERSISTED here at provision time; a separate Phase-2 PR reads + enforces
+ * it. These tests cover the read/write/upsert/remove primitives + the "no row
+ * = uncapped" contract the Phase-2 reader relies on.
+ */
+import { describe, expect, test } from "bun:test";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { hubDbPath, openHubDb } from "../hub-db.ts";
+import {
+  DEFAULT_VAULT_CAP_BYTES,
+  getVaultCap,
+  getVaultCapBytes,
+  removeVaultCap,
+  setVaultCap,
+} from "../vault-caps.ts";
+
+function makeDb() {
+  const dir = mkdtempSync(join(tmpdir(), "phub-vault-caps-"));
+  const db = openHubDb(hubDbPath(dir));
+  return {
+    db,
+    cleanup: () => {
+      db.close();
+      rmSync(dir, { recursive: true, force: true });
+    },
+  };
+}
+
+describe("vault-caps", () => {
+  test("default cap constant is ~1 GiB", () => {
+    expect(DEFAULT_VAULT_CAP_BYTES).toBe(1024 * 1024 * 1024);
+  });
+
+  test("no row = uncapped (null) — the Phase-2 reader's contract", () => {
+    const { db, cleanup } = makeDb();
+    try {
+      expect(getVaultCap(db, "nope")).toBeNull();
+      expect(getVaultCapBytes(db, "nope")).toBeNull();
+    } finally {
+      cleanup();
+    }
+  });
+
+  test("setVaultCap persists, getVaultCapBytes reads it back", () => {
+    const { db, cleanup } = makeDb();
+    try {
+      const now = new Date("2026-06-25T00:00:00Z");
+      const cap = setVaultCap(db, "alice", DEFAULT_VAULT_CAP_BYTES, now);
+      expect(cap.vaultName).toBe("alice");
+      expect(cap.capBytes).toBe(DEFAULT_VAULT_CAP_BYTES);
+      expect(cap.createdAt).toBe(now.toISOString());
+      expect(getVaultCapBytes(db, "alice")).toBe(DEFAULT_VAULT_CAP_BYTES);
+    } finally {
+      cleanup();
+    }
+  });
+
+  test("upsert: re-set overwrites cap_bytes, bumps updated_at, preserves created_at", () => {
+    const { db, cleanup } = makeDb();
+    try {
+      const t0 = new Date("2026-06-25T00:00:00Z");
+      const t1 = new Date("2026-06-26T00:00:00Z");
+      setVaultCap(db, "alice", 1000, t0);
+      const updated = setVaultCap(db, "alice", 2000, t1);
+      expect(updated.capBytes).toBe(2000);
+      expect(updated.createdAt).toBe(t0.toISOString()); // preserved
+      expect(updated.updatedAt).toBe(t1.toISOString()); // bumped
+      expect(getVaultCapBytes(db, "alice")).toBe(2000);
+    } finally {
+      cleanup();
+    }
+  });
+
+  test("removeVaultCap drops the row (cascade parity) — returns count", () => {
+    const { db, cleanup } = makeDb();
+    try {
+      setVaultCap(db, "alice", 1000);
+      expect(removeVaultCap(db, "alice")).toBe(1);
+      expect(getVaultCapBytes(db, "alice")).toBeNull();
+      // Idempotent — removing a missing row is 0.
+      expect(removeVaultCap(db, "alice")).toBe(0);
+    } finally {
+      cleanup();
+    }
+  });
+});

package/src/__tests__/vault-hub-origin-env.test.ts

@@ -76,13 +76,29 @@ describe("persistVaultHubOrigin", () => {
     expect(existsSync(vaultEnv())).toBe(false);
   });
 
-  test("is idempotent — no rewrite when the value is already current", () => {
+  test("is idempotent — no rewrite when both the origin and the set are current", () => {
     const log: string[] = [];
     expect(persistVaultHubOrigin(dir, "https://hub.example.com", (l) => log.push(l))).toBe(true);
+    // First call wrote BOTH the single origin and the multi-origin set.
+    expect(
+      log.some((l) => /persisted PARACHUTE_HUB_ORIGIN=https:\/\/hub\.example\.com/.test(l)),
+    ).toBe(true);
+    expect(log.some((l) => /persisted PARACHUTE_HUB_ORIGINS=/.test(l))).toBe(true);
+    const writesAfterFirst = log.length;
+    // Second call is a no-op: both values already current → false, no new logs.
     expect(persistVaultHubOrigin(dir, "https://hub.example.com", (l) => log.push(l))).toBe(false);
-    // Only the first call logged.
-    expect(log).toHaveLength(1);
-    expect(log[0]).toMatch(/persisted PARACHUTE_HUB_ORIGIN=https:\/\/hub\.example\.com/);
+    expect(log).toHaveLength(writesAfterFirst);
+  });
+
+  test("writes PARACHUTE_HUB_ORIGINS (multi-origin iss-set) alongside the single origin", () => {
+    expect(persistVaultHubOrigin(dir, "https://hub.example.com", () => {})).toBe(true);
+    const values = readEnvFileValues(vaultEnv());
+    expect(values.PARACHUTE_HUB_ORIGIN).toBe("https://hub.example.com");
+    // The set carries the issuer + loopback aliases (always present).
+    const set = (values.PARACHUTE_HUB_ORIGINS ?? "").split(",");
+    expect(set).toContain("https://hub.example.com");
+    expect(set.some((o) => o.startsWith("http://127.0.0.1:"))).toBe(true);
+    expect(set.some((o) => o.startsWith("http://localhost:"))).toBe(true);
   });
 
   test("updates a stale origin in-place and preserves sibling keys", () => {
@@ -113,6 +129,24 @@ describe("clearVaultHubOrigin", () => {
     expect(values.SCRIBE_AUTH_TOKEN).toBe("secret");
   });
 
+  test("removes BOTH the single origin and the multi-origin set, leaving siblings", () => {
+    writeFileSync(
+      mkVaultDir(),
+      "SCRIBE_AUTH_TOKEN=secret\nPARACHUTE_HUB_ORIGIN=https://hub.example.com\nPARACHUTE_HUB_ORIGINS=https://hub.example.com,http://127.0.0.1:1939\n",
+    );
+    expect(clearVaultHubOrigin(dir, () => {})).toBe(true);
+    const values = readEnvFileValues(vaultEnv());
+    expect(values.PARACHUTE_HUB_ORIGIN).toBeUndefined();
+    expect(values.PARACHUTE_HUB_ORIGINS).toBeUndefined();
+    expect(values.SCRIBE_AUTH_TOKEN).toBe("secret");
+  });
+
+  test("clears a lone PARACHUTE_HUB_ORIGINS even if the single origin is absent", () => {
+    writeFileSync(mkVaultDir(), "PARACHUTE_HUB_ORIGINS=https://hub.example.com\n");
+    expect(clearVaultHubOrigin(dir, () => {})).toBe(true);
+    expect(readEnvFileValues(vaultEnv()).PARACHUTE_HUB_ORIGINS).toBeUndefined();
+  });
+
   test("no-op when no origin is present", () => {
     writeFileSync(mkVaultDir(), "SCRIBE_AUTH_TOKEN=secret\n");
     expect(clearVaultHubOrigin(dir, () => {})).toBe(false);

package/src/__tests__/wizard-transcription.test.ts

@@ -0,0 +1,334 @@
+/**
+ * CLI wizard transcription step (onboarding-streamline hub PR1).
+ *
+ * Exercises `walkTranscriptionStep` against an injected command runner + RAM
+ * probe + platform — NOTHING installs and no subprocess is spawned. Covers the
+ * four branches the brief calls for: the CLI transcription question, the
+ * platform mapping, the RAM gate, and install-or-skip (mocked scribe
+ * subprocess).
+ */
+
+import { describe, expect, test } from "bun:test";
+import { existsSync, mkdtempSync, readFileSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { walkTranscriptionStep } from "../commands/wizard-transcription.ts";
+import { scribeConfigPath } from "../scribe-config.ts";
+
+function makeHarness(): { dir: string; cleanup: () => void } {
+  const dir = mkdtempSync(join(tmpdir(), "pcli-wztrans-"));
+  return { dir, cleanup: () => rmSync(dir, { recursive: true, force: true }) };
+}
+
+/** Records every command the step would have spawned, returns scripted codes. */
+function recordingRunner(codes: number[] = []) {
+  const cmds: string[][] = [];
+  let i = 0;
+  return {
+    cmds,
+    run: async (cmd: readonly string[]): Promise<number> => {
+      cmds.push([...cmd]);
+      const code = codes[i++];
+      return code ?? 0;
+    },
+  };
+}
+
+function readCfg(dir: string): Record<string, unknown> | undefined {
+  const p = scribeConfigPath(dir);
+  if (!existsSync(p)) return undefined;
+  return JSON.parse(readFileSync(p, "utf8")) as Record<string, unknown>;
+}
+
+describe("walkTranscriptionStep — mode resolution (the CLI question)", () => {
+  test("none: writes no scribe config, runs no command", async () => {
+    const h = makeHarness();
+    try {
+      const r = recordingRunner();
+      const logs: string[] = [];
+      const code = await walkTranscriptionStep({
+        configDir: h.dir,
+        log: (l) => logs.push(l),
+        transcribeMode: "none",
+        runCommand: r.run,
+        platform: "linux",
+      });
+      expect(code).toBe(0);
+      expect(r.cmds).toEqual([]);
+      expect(readCfg(h.dir)).toBeUndefined();
+      expect(logs.join("\n")).toContain("Transcription off");
+    } finally {
+      h.cleanup();
+    }
+  });
+
+  test("interactive prompt: '1' chooses none", async () => {
+    const h = makeHarness();
+    try {
+      const r = recordingRunner();
+      const answers = ["1"];
+      let i = 0;
+      const code = await walkTranscriptionStep({
+        configDir: h.dir,
+        log: () => {},
+        prompt: async () => answers[i++] ?? "",
+        runCommand: r.run,
+        platform: "linux",
+      });
+      expect(code).toBe(0);
+      expect(r.cmds).toEqual([]);
+    } finally {
+      h.cleanup();
+    }
+  });
+
+  test("interactive prompt: '3' then 'g' chooses groq cloud", async () => {
+    const h = makeHarness();
+    try {
+      const r = recordingRunner([0]);
+      const answers = ["3", "g", "gsk_interactive"];
+      let i = 0;
+      const code = await walkTranscriptionStep({
+        configDir: h.dir,
+        log: () => {},
+        prompt: async () => answers[i++] ?? "",
+        runCommand: r.run,
+        platform: "linux",
+      });
+      expect(code).toBe(0);
+      // One install command, with the groq provider + key.
+      expect(r.cmds.length).toBe(1);
+      expect(r.cmds[0]).toEqual([
+        "parachute",
+        "install",
+        "scribe",
+        "--scribe-provider",
+        "groq",
+        "--scribe-key",
+        "gsk_interactive",
+      ]);
+    } finally {
+      h.cleanup();
+    }
+  });
+});
+
+describe("walkTranscriptionStep — cloud (install-or-skip via the one-shot)", () => {
+  test("groq with a key: install one-shot carries provider + key", async () => {
+    const h = makeHarness();
+    try {
+      const r = recordingRunner([0]);
+      const code = await walkTranscriptionStep({
+        configDir: h.dir,
+        log: () => {},
+        transcribeMode: "groq",
+        transcribeApiKey: "gsk_abc123",
+        runCommand: r.run,
+        platform: "linux",
+      });
+      expect(code).toBe(0);
+      expect(r.cmds[0]).toEqual([
+        "parachute",
+        "install",
+        "scribe",
+        "--scribe-provider",
+        "groq",
+        "--scribe-key",
+        "gsk_abc123",
+      ]);
+    } finally {
+      h.cleanup();
+    }
+  });
+
+  test("openai without a key: install one-shot omits --scribe-key + tells operator how to add it", async () => {
+    const h = makeHarness();
+    try {
+      const r = recordingRunner([0]);
+      const logs: string[] = [];
+      const code = await walkTranscriptionStep({
+        configDir: h.dir,
+        log: (l) => logs.push(l),
+        transcribeMode: "openai",
+        transcribeApiKey: "",
+        runCommand: r.run,
+        platform: "darwin",
+      });
+      expect(code).toBe(0);
+      expect(r.cmds[0]).toEqual(["parachute", "install", "scribe", "--scribe-provider", "openai"]);
+      expect(logs.join("\n")).toContain("OPENAI_API_KEY");
+    } finally {
+      h.cleanup();
+    }
+  });
+
+  test("cloud install failure: surfaces the non-zero exit + a retry hint, still exits 0", async () => {
+    const h = makeHarness();
+    try {
+      const r = recordingRunner([1]); // install fails
+      const logs: string[] = [];
+      const code = await walkTranscriptionStep({
+        configDir: h.dir,
+        log: (l) => logs.push(l),
+        transcribeMode: "groq",
+        transcribeApiKey: "gsk_x",
+        runCommand: r.run,
+        platform: "linux",
+      });
+      expect(code).toBe(0); // non-fatal — doesn't block the wizard
+      expect(logs.join("\n")).toContain("returned 1");
+    } finally {
+      h.cleanup();
+    }
+  });
+});
+
+describe("walkTranscriptionStep — local install-or-skip", () => {
+  test("Linux, ample RAM, install succeeds: install-backend uses onnx-asr; provider kept", async () => {
+    const h = makeHarness();
+    try {
+      // module install (writes provider via --scribe-provider), install-backend, restart
+      const r = recordingRunner([0, 0, 0]);
+      const code = await walkTranscriptionStep({
+        configDir: h.dir,
+        log: () => {},
+        transcribeMode: "local",
+        runCommand: r.run,
+        platform: "linux",
+        availableRamMib: 4096,
+      });
+      expect(code).toBe(0);
+      // Module install pins the resolved Linux backend, NOT parakeet-mlx.
+      expect(r.cmds[0]).toEqual([
+        "parachute",
+        "install",
+        "scribe",
+        "--scribe-provider",
+        "onnx-asr",
+      ]);
+      // scribe's own runnable install routine, targeting onnx-asr.
+      expect(r.cmds[1]).toEqual(["parachute-scribe", "install-backend", "--provider", "onnx-asr"]);
+      // A restart so the running scribe picks up the engine.
+      expect(r.cmds[2]).toEqual(["parachute", "restart", "scribe"]);
+    } finally {
+      h.cleanup();
+    }
+  });
+
+  test("macOS local resolves to parakeet-mlx", async () => {
+    const h = makeHarness();
+    try {
+      const r = recordingRunner([0, 0, 0]);
+      await walkTranscriptionStep({
+        configDir: h.dir,
+        log: () => {},
+        transcribeMode: "local",
+        runCommand: r.run,
+        platform: "darwin",
+        availableRamMib: 16384,
+      });
+      expect(r.cmds[1]).toEqual([
+        "parachute-scribe",
+        "install-backend",
+        "--provider",
+        "parakeet-mlx",
+      ]);
+    } finally {
+      h.cleanup();
+    }
+  });
+
+  test("install-backend FAILS: clears the provisional provider (no dead string) + points at cloud", async () => {
+    const h = makeHarness();
+    try {
+      // module install OK, install-backend FAILS (exit 3). No restart should run.
+      const r = recordingRunner([0, 3]);
+      const logs: string[] = [];
+      const code = await walkTranscriptionStep({
+        configDir: h.dir,
+        log: (l) => logs.push(l),
+        transcribeMode: "local",
+        runCommand: r.run,
+        platform: "linux",
+        availableRamMib: 4096,
+      });
+      expect(code).toBe(0);
+      // Only two commands ran — the failed install-backend, no restart.
+      expect(r.cmds.length).toBe(2);
+      expect(r.cmds.some((c) => c[0] === "parachute" && c[1] === "restart")).toBe(false);
+      // The provisional provider write (by the install one-shot in production)
+      // is cleared. We simulate the install having written it by checking the
+      // step never leaves a transcribe.provider on its own write path — and the
+      // honest cloud steer is logged.
+      expect(logs.join("\n")).toContain("install failed");
+      expect(logs.join("\n")).toContain("Cloud alternative");
+    } finally {
+      h.cleanup();
+    }
+  });
+
+  test("RAM below floor: REFUSES local, records nothing, steers to cloud one-shot", async () => {
+    const h = makeHarness();
+    try {
+      const r = recordingRunner();
+      const logs: string[] = [];
+      const code = await walkTranscriptionStep({
+        configDir: h.dir,
+        log: (l) => logs.push(l),
+        transcribeMode: "local",
+        runCommand: r.run,
+        platform: "linux",
+        availableRamMib: 900, // 1 GB droplet
+      });
+      expect(code).toBe(0);
+      // Nothing installed, nothing recorded.
+      expect(r.cmds).toEqual([]);
+      expect(readCfg(h.dir)).toBeUndefined();
+      const joined = logs.join("\n");
+      expect(joined).toContain("isn't possible");
+      expect(joined).toContain("parachute install scribe --scribe-provider groq");
+    } finally {
+      h.cleanup();
+    }
+  });
+
+  test("unsupported platform: REFUSES local + steers to cloud, no install", async () => {
+    const h = makeHarness();
+    try {
+      const r = recordingRunner();
+      const code = await walkTranscriptionStep({
+        configDir: h.dir,
+        log: () => {},
+        transcribeMode: "local",
+        runCommand: r.run,
+        platform: "win32",
+        availableRamMib: 99999,
+      });
+      expect(code).toBe(0);
+      expect(r.cmds).toEqual([]);
+      expect(readCfg(h.dir)).toBeUndefined();
+    } finally {
+      h.cleanup();
+    }
+  });
+
+  test("module install fails before the engine: clears provider, no install-backend run", async () => {
+    const h = makeHarness();
+    try {
+      const r = recordingRunner([5]); // module install fails
+      const code = await walkTranscriptionStep({
+        configDir: h.dir,
+        log: () => {},
+        transcribeMode: "local",
+        runCommand: r.run,
+        platform: "linux",
+        availableRamMib: 4096,
+      });
+      expect(code).toBe(0);
+      expect(r.cmds.length).toBe(1);
+      expect(r.cmds[0]?.[1]).toBe("install");
+    } finally {
+      h.cleanup();
+    }
+  });
+});