@openparachute/hub 0.7.3-rc.1 → 0.7.3-rc.10

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openparachute/hub",
-  "version": "0.7.3-rc.1",
+  "version": "0.7.3-rc.10",
   "description": "parachute — the local hub for the Parachute ecosystem (discovery, ports, lifecycle, soon OAuth).",
   "license": "AGPL-3.0",
   "publishConfig": {

package/src/__tests__/admin-agent-grants.test.ts

@@ -1353,6 +1353,119 @@ describe("GET /oauth/agent-grant/callback", () => {
   });
 });
 
+// === returnTo: send the operator back to where they started ================
+//
+// The OAuth-consent round-trip used to dead-end on a "close this tab" page. A
+// same-origin (hub-relative) `returnTo` on the approve body is stashed on the
+// flow + 302'd to on success (with `?mcp_connected=1`). The open-redirect guard
+// (`isSafeHubReturnTo`, reused) is the load-bearing property: an off-origin /
+// scheme-relative value is dropped at stash time and never lands in Location.
+describe("approve(mcp) + callback — returnTo round-trip", () => {
+  async function startFlowWithBody(body: Record<string, unknown>): Promise<string> {
+    const bearer = await moduleBearer();
+    const cookie = await operatorCookie();
+    const created = await json(
+      await dispatch(
+        bearerReq("PUT", "/admin/grants", bearer, {
+          agent: "a",
+          connection: { kind: "mcp", target: "https://remote.test/mcp" },
+        }),
+      ),
+    );
+    const id = created.id as string;
+    await dispatch(cookieReq("POST", `/admin/grants/${id}/approve`, cookie, body));
+    return id;
+  }
+
+  test("approve stashes a valid same-origin returnTo on the flow", async () => {
+    currentOAuth = fakeOAuth();
+    await startFlowWithBody({ returnTo: "/admin/grants" });
+    const flow = getFlowByState(harness.flowsStorePath, "fixed-state");
+    expect(flow?.returnTo).toBe("/admin/grants");
+  });
+
+  test("approve drops an off-origin returnTo (absolute URL) — open-redirect guard", async () => {
+    currentOAuth = fakeOAuth();
+    await startFlowWithBody({ returnTo: "https://evil.example/steal" });
+    const flow = getFlowByState(harness.flowsStorePath, "fixed-state");
+    expect(flow?.returnTo).toBeUndefined();
+  });
+
+  test("approve drops a scheme-relative returnTo (//host) — open-redirect guard", async () => {
+    currentOAuth = fakeOAuth();
+    await startFlowWithBody({ returnTo: "//evil.example/steal" });
+    const flow = getFlowByState(harness.flowsStorePath, "fixed-state");
+    expect(flow?.returnTo).toBeUndefined();
+  });
+
+  test("approve drops a `..` path-traversal returnTo — open-redirect guard", async () => {
+    currentOAuth = fakeOAuth();
+    await startFlowWithBody({ returnTo: "/admin/../../etc/passwd" });
+    const flow = getFlowByState(harness.flowsStorePath, "fixed-state");
+    expect(flow?.returnTo).toBeUndefined();
+  });
+
+  test("approve drops a PERCENT-ENCODED `..` returnTo (%2e%2e) — open-redirect guard", async () => {
+    // `new URL()` decodes %2e%2e before emitting the redirect path, so the guard
+    // must reject the encoded form too, not just the literal `..`.
+    currentOAuth = fakeOAuth();
+    await startFlowWithBody({ returnTo: "/%2e%2e/etc/passwd" });
+    const flow = getFlowByState(harness.flowsStorePath, "fixed-state");
+    expect(flow?.returnTo).toBeUndefined();
+  });
+
+  test("callback 302-redirects to a valid returnTo (with mcp_connected=1) on success", async () => {
+    currentOAuth = fakeOAuth();
+    const id = await startFlowWithBody({ returnTo: "/admin/grants?agent=a" });
+    const res = await callback("?code=ok&state=fixed-state");
+    expect(res.status).toBe(302);
+    const location = res.headers.get("location") ?? "";
+    expect(location).toContain("/admin/grants");
+    expect(location).toContain("agent=a");
+    expect(location).toContain("mcp_connected=1");
+    // Same-origin only — never a host/scheme in Location.
+    expect(location.startsWith("/")).toBe(true);
+    expect(location.startsWith("//")).toBe(false);
+    // The grant still flipped to approved (the success side-effects all ran).
+    expect(readGrants(harness.storePath).find((r) => r.id === id)?.status).toBe("approved");
+  });
+
+  test("callback overwrites a pre-existing mcp_connected param rather than duplicating it", async () => {
+    currentOAuth = fakeOAuth();
+    await startFlowWithBody({ returnTo: "/admin/grants?mcp_connected=0" });
+    const res = await callback("?code=ok&state=fixed-state");
+    expect(res.status).toBe(302);
+    const location = res.headers.get("location") ?? "";
+    expect(location).toContain("mcp_connected=1");
+    expect(location).not.toContain("mcp_connected=0");
+    // exactly one occurrence (searchParams.set semantics, not append)
+    expect(location.match(/mcp_connected=/g)?.length).toBe(1);
+  });
+
+  test("callback falls back to the close-tab HTML when no returnTo was stashed", async () => {
+    currentOAuth = fakeOAuth();
+    const id = await startFlowWithBody({}); // no returnTo
+    const res = await callback("?code=ok&state=fixed-state");
+    expect(res.status).toBe(200);
+    expect(res.headers.get("content-type")).toContain("text/html");
+    expect(await res.text()).toContain("Connected");
+    expect(readGrants(harness.storePath).find((r) => r.id === id)?.status).toBe("approved");
+  });
+
+  test("callback falls back to the close-tab HTML for an unsafe returnTo (never 302s off-origin)", async () => {
+    currentOAuth = fakeOAuth();
+    // The unsafe value was already dropped at stash time, so the callback has no
+    // returnTo to honor — it renders the back-compat page rather than redirecting.
+    const id = await startFlowWithBody({ returnTo: "https://evil.example/steal" });
+    const res = await callback("?code=ok&state=fixed-state");
+    expect(res.status).toBe(200);
+    expect(res.headers.get("content-type")).toContain("text/html");
+    expect(res.headers.get("location")).toBeNull();
+    expect(await res.text()).toContain("Connected");
+    expect(readGrants(harness.storePath).find((r) => r.id === id)?.status).toBe("approved");
+  });
+});
+
 describe("material(mcp) — auto-refresh", () => {
   // Drive a grant to approved-via-OAuth, with expiry in the (near) past/future.
   async function approvedViaOAuth(expiresAt: string): Promise<string> {

package/src/__tests__/admin-vaults.test.ts

@@ -733,6 +733,7 @@ import { findGrant, recordGrant } from "../grants.ts";
 import { findInviteByHash, issueInvite } from "../invites.ts";
 import { findTokenRowByJti, listActiveRevocations, recordTokenMint } from "../jwt-sign.ts";
 import { createUser, setUserVaults } from "../users.ts";
+import { getVaultCapBytes, setVaultCap } from "../vault-caps.ts";
 
 const VAULT_ORIGIN = "http://127.0.0.1:19400";
 const AGENT_ORIGIN = "http://127.0.0.1:19410";
@@ -1026,11 +1027,19 @@ describe("DELETE /vaults/<name> — the identity cascade", () => {
         const pendingWork = issueInvite(db, { createdBy: alice.id, vaultName: "work" });
         const pendingDefault = issueInvite(db, { createdBy: alice.id, vaultName: "default" });
         const redeemedWork = issueInvite(db, { createdBy: alice.id, vaultName: "work" });
-        db.prepare("UPDATE invites SET used_at = ?, redeemed_user_id = ? WHERE token = ?").run(
-          new Date().toISOString(),
-          alice.id,
-          redeemedWork.invite.tokenHash,
-        );
+        // Simulate a fully-redeemed single-use invite exactly as the redeem path
+        // leaves it (v15): used_at stamped AND used_count bumped to max_uses, so
+        // the cascade's `used_count < max_uses` exhaustion guard treats it as
+        // terminal (untouched), same as the pre-v15 `used_at IS NULL` guard did.
+        db.prepare(
+          "UPDATE invites SET used_at = ?, used_count = 1, redeemed_user_id = ? WHERE token = ?",
+        ).run(new Date().toISOString(), alice.id, redeemedWork.invite.tokenHash);
+
+        // 4b. vault_caps (v15): one row per vault. The work row is dropped by
+        //     the cascade; the default row stays (a re-created same-name vault
+        //     must not inherit a stale cap).
+        setVaultCap(db, "work", 1024 * 1024 * 1024);
+        setVaultCap(db, "default", 2 * 1024 * 1024 * 1024);
 
         // 5. Connections: one sourced on work (torn down), one on default (kept).
         putConnection(store, {
@@ -1092,6 +1101,7 @@ describe("DELETE /vaults/<name> — the identity cascade", () => {
             grants_dropped: number;
             user_vaults_removed: number;
             invites_invalidated: number;
+            vault_cap_removed: boolean;
             connections_torn_down: number;
             orphaned_channels: string[];
             vault_removed: boolean;
@@ -1134,6 +1144,11 @@ describe("DELETE /vaults/<name> — the identity cascade", () => {
         expect(findInviteByHash(db, redeemedWork.invite.tokenHash)?.usedAt).not.toBeNull();
         expect(findInviteByHash(db, redeemedWork.invite.tokenHash)?.revokedAt).toBeNull();
 
+        // 4b. vault_caps: the work cap row dropped; the default cap row stays.
+        expect(out.cascade.vault_cap_removed).toBe(true);
+        expect(getVaultCapBytes(db, "work")).toBeNull();
+        expect(getVaultCapBytes(db, "default")).toBe(2 * 1024 * 1024 * 1024);
+
         // 5. Connections: work connection torn down (trigger deregistered +
         //    channel entry deleted + record removed); default connection kept.
         expect(out.cascade.connections_torn_down).toBe(1);

package/src/__tests__/api-modules.test.ts

@@ -219,9 +219,11 @@ describe("GET /api/modules", () => {
     // yet. Post-2026-06-09 (modular-UI architecture, P2) discovery is driven
     // by the UNION of the bootstrap registries (KNOWN_MODULES ∪
     // FIRST_PARTY_FALLBACKS), NOT a curated whitelist. Every known module
-    // surfaces — core (vault/scribe/surface) in the headline tier, the rest
-    // (agent/runner/notes) as `experimental` — so the agent-not-installed
-    // class (running but invisible) can't recur.
+    // surfaces — core (vault/scribe/surface) in the headline tier, agent as
+    // `experimental`, and notes/runner as `deprecated` (2026-06-25, still
+    // resolvable but not offered for fresh installs) — so the agent-not-installed
+    // class (running but invisible) can't recur while deprecated modules stop
+    // being pushed on a fresh box.
     const bearer = await mintBearer(h, [API_MODULES_REQUIRED_SCOPE]);
     const res = await handleApiModules(getReq({ authorization: `Bearer ${bearer}` }), {
       db: h.db,
@@ -233,8 +235,9 @@ describe("GET /api/modules", () => {
     const body = (await res.json()) as {
       modules: Array<{
         short: string;
-        focus: "core" | "experimental";
+        focus: "core" | "experimental" | "deprecated";
         available: boolean;
+        available_to_install: boolean;
         installed: boolean;
         latest_version: string | null;
       }>;
@@ -242,12 +245,14 @@ describe("GET /api/modules", () => {
     };
     const shorts = body.modules.map((m) => m.short);
     // The core tier leads, in the recommended install order (vault → scribe),
-    // ahead of every experimental module.
+    // ahead of every experimental module, which lead the deprecated ones.
     expect(shorts.indexOf("vault")).toBeLessThan(shorts.indexOf("scribe"));
     expect(shorts.indexOf("scribe")).toBeLessThan(shorts.indexOf("agent"));
-    expect(shorts.indexOf("scribe")).toBeLessThan(shorts.indexOf("runner"));
-    // Every known module is discoverable — vault/scribe/surface (core) +
-    // agent/runner/notes (experimental).
+    // agent (experimental) sorts ahead of notes/runner (deprecated).
+    expect(shorts.indexOf("agent")).toBeLessThan(shorts.indexOf("runner"));
+    expect(shorts.indexOf("agent")).toBeLessThan(shorts.indexOf("notes"));
+    // Every known module is discoverable — vault/scribe/surface (core),
+    // agent (experimental), notes/runner (deprecated).
     for (const s of ["vault", "scribe", "surface", "agent", "runner", "notes"]) {
       expect(shorts).toContain(s);
     }
@@ -257,15 +262,65 @@ describe("GET /api/modules", () => {
     expect(byShort.get("scribe")?.focus).toBe("core");
     expect(byShort.get("surface")?.focus).toBe("core");
     expect(byShort.get("agent")?.focus).toBe("experimental");
-    expect(byShort.get("runner")?.focus).toBe("experimental");
-    expect(byShort.get("notes")?.focus).toBe("experimental");
+    expect(byShort.get("runner")?.focus).toBe("deprecated");
+    expect(byShort.get("notes")?.focus).toBe("deprecated");
+    // `available` stays true for every known module (re-installable), but the
+    // fresh-install OFFER (`available_to_install`) drops the deprecated tier —
+    // notes/runner aren't pushed on a fresh box; agent (experimental) still is.
     expect(body.modules.every((m) => m.available)).toBe(true);
+    expect(byShort.get("vault")?.available_to_install).toBe(true);
+    expect(byShort.get("scribe")?.available_to_install).toBe(true);
+    expect(byShort.get("surface")?.available_to_install).toBe(true);
+    expect(byShort.get("agent")?.available_to_install).toBe(true);
+    expect(byShort.get("runner")?.available_to_install).toBe(false);
+    expect(byShort.get("notes")?.available_to_install).toBe(false);
     expect(body.modules.every((m) => !m.installed)).toBe(true);
     expect(body.modules.every((m) => m.latest_version === "0.9.9")).toBe(true);
     // Supervisor wasn't injected → flag reflects that.
     expect(body.supervisor_available).toBe(false);
   });
 
+  test("an installed deprecated module (runner) still surfaces for management but is not offered for fresh install (2026-06-25)", async () => {
+    // A legacy operator with runner on disk: the row must remain visible
+    // (installed: true) + manageable, in the `deprecated` tier — but
+    // `available_to_install` is false so the SPA's install catalog won't push
+    // it. Mirrors the notes-daemon back-compat posture.
+    writeManifest(h.manifestPath, [
+      {
+        name: "parachute-runner",
+        port: 1945,
+        paths: ["/runner", "/.parachute"],
+        health: "/runner/healthz",
+        version: "0.2.0",
+      },
+    ]);
+    const bearer = await mintBearer(h, [API_MODULES_REQUIRED_SCOPE]);
+    const res = await handleApiModules(getReq({ authorization: `Bearer ${bearer}` }), {
+      db: h.db,
+      issuer: ISSUER,
+      manifestPath: h.manifestPath,
+      fetchLatestVersion: async () => null,
+    });
+    const body = (await res.json()) as {
+      modules: Array<{
+        short: string;
+        focus: "core" | "experimental" | "deprecated";
+        installed: boolean;
+        installed_version: string | null;
+        available: boolean;
+        available_to_install: boolean;
+      }>;
+    };
+    const runner = body.modules.find((m) => m.short === "runner");
+    expect(runner).toBeDefined();
+    expect(runner?.installed).toBe(true);
+    expect(runner?.installed_version).toBe("0.2.0");
+    expect(runner?.focus).toBe("deprecated");
+    // Still hub-installable (re-install path) but NOT offered fresh.
+    expect(runner?.available).toBe(true);
+    expect(runner?.available_to_install).toBe(false);
+  });
+
   test("scribe row carries package + display props from KNOWN_MODULES", async () => {
     // Spot-check the wire shape resolves scribe-specific fields
     // (package, displayName, tagline) from KNOWN_MODULES rather than a

package/src/__tests__/api-vault-caps.test.ts

@@ -0,0 +1,232 @@
+/**
+ * Tests for `/api/vault-caps*` (B5 admin visibility / D-slice).
+ * Covers:
+ *
+ *   - Auth boundary: GET + PUT require a bearer carrying `parachute:host:admin`.
+ *   - GET joins services.json vault names with persisted caps (uncapped =
+ *     null cap_bytes), ordered by name.
+ *   - PUT sets/updates a cap (upsert), validates positive cap, refuses a
+ *     vault not registered in services.json (400 vault_not_found).
+ *   - 405 on wrong methods.
+ */
+import type { Database } from "bun:sqlite";
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { handleListVaultCaps, handleSetVaultCap } from "../api-vault-caps.ts";
+import { hubDbPath, openHubDb } from "../hub-db.ts";
+import { signAccessToken } from "../jwt-sign.ts";
+import { createUser } from "../users.ts";
+import { getVaultCapBytes, setVaultCap } from "../vault-caps.ts";
+
+const ISSUER = "https://hub.test";
+const HOST_ADMIN_SCOPE = "parachute:host:admin";
+
+interface Harness {
+  db: Database;
+  manifestPath: string;
+  cleanup: () => void;
+}
+
+function manifestWithVaults(...names: string[]): string {
+  const paths = names.map((n) => `/vault/${n}`);
+  return JSON.stringify({
+    services: [
+      { name: "parachute-vault", port: 4101, paths, health: "/health", version: "0.0.0-test" },
+    ],
+  });
+}
+
+function makeHarness(servicesJson?: string): Harness {
+  const dir = mkdtempSync(join(tmpdir(), "phub-api-vault-caps-"));
+  const db = openHubDb(hubDbPath(dir));
+  const manifestPath = join(dir, "services.json");
+  writeFileSync(manifestPath, servicesJson ?? manifestWithVaults("beta", "personal"));
+  return {
+    db,
+    manifestPath,
+    cleanup: () => {
+      db.close();
+      rmSync(dir, { recursive: true, force: true });
+    },
+  };
+}
+
+let harness: Harness;
+beforeEach(() => {
+  harness = makeHarness();
+});
+afterEach(() => {
+  harness.cleanup();
+});
+
+async function makeAdminBearer(scopes = [HOST_ADMIN_SCOPE]): Promise<string> {
+  const user = await createUser(harness.db, "operator", "any-password", {
+    allowMulti: true,
+    passwordChanged: true,
+  });
+  const minted = await signAccessToken(harness.db, {
+    sub: user.id,
+    scopes,
+    audience: "hub",
+    clientId: "parachute-hub-spa",
+    issuer: ISSUER,
+    ttlSeconds: 600,
+  });
+  return minted.token;
+}
+
+function req(path: string, init: RequestInit = {}): Request {
+  return new Request(`${ISSUER}${path}`, init);
+}
+
+function withBearer(path: string, bearer: string, init: RequestInit = {}): Request {
+  const headers = new Headers(init.headers ?? {});
+  headers.set("authorization", `Bearer ${bearer}`);
+  return new Request(`${ISSUER}${path}`, { ...init, headers });
+}
+
+function deps() {
+  return { db: harness.db, issuer: ISSUER, manifestPath: harness.manifestPath };
+}
+
+describe("handleListVaultCaps", () => {
+  test("401 with no Authorization header", async () => {
+    const res = await handleListVaultCaps(req("/api/vault-caps"), deps());
+    expect(res.status).toBe(401);
+  });
+
+  test("403 when bearer lacks parachute:host:admin", async () => {
+    const bearer = await makeAdminBearer(["other:scope"]);
+    const res = await handleListVaultCaps(withBearer("/api/vault-caps", bearer), deps());
+    expect(res.status).toBe(403);
+  });
+
+  test("405 on POST", async () => {
+    const bearer = await makeAdminBearer();
+    const res = await handleListVaultCaps(
+      withBearer("/api/vault-caps", bearer, { method: "POST" }),
+      deps(),
+    );
+    expect(res.status).toBe(405);
+  });
+
+  test("joins services.json vaults with caps, uncapped = null cap_bytes", async () => {
+    const bearer = await makeAdminBearer();
+    // Only "beta" has a persisted cap; "personal" stays uncapped.
+    setVaultCap(harness.db, "beta", 1024 * 1024 * 1024);
+    const res = await handleListVaultCaps(withBearer("/api/vault-caps", bearer), deps());
+    expect(res.status).toBe(200);
+    expect(res.headers.get("cache-control")).toBe("no-store");
+    const body = (await res.json()) as {
+      vault_caps: Array<{ vault_name: string; cap_bytes: number | null }>;
+    };
+    // Both vaults present, ordered by name (beta, personal).
+    expect(body.vault_caps.map((c) => c.vault_name)).toEqual(["beta", "personal"]);
+    const beta = body.vault_caps.find((c) => c.vault_name === "beta");
+    const personal = body.vault_caps.find((c) => c.vault_name === "personal");
+    expect(beta?.cap_bytes).toBe(1024 * 1024 * 1024);
+    expect(personal?.cap_bytes).toBeNull();
+  });
+});
+
+describe("handleSetVaultCap", () => {
+  test("401 with no Authorization header", async () => {
+    const res = await handleSetVaultCap(
+      req("/api/vault-caps/beta", {
+        method: "PUT",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ cap_bytes: 1000 }),
+      }),
+      "beta",
+      deps(),
+    );
+    expect(res.status).toBe(401);
+  });
+
+  test("403 when bearer lacks parachute:host:admin", async () => {
+    const bearer = await makeAdminBearer(["other:scope"]);
+    const res = await handleSetVaultCap(
+      withBearer("/api/vault-caps/beta", bearer, {
+        method: "PUT",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ cap_bytes: 1000 }),
+      }),
+      "beta",
+      deps(),
+    );
+    expect(res.status).toBe(403);
+  });
+
+  test("400 on a fractional (non-integer) cap", async () => {
+    const bearer = await makeAdminBearer();
+    const res = await handleSetVaultCap(
+      withBearer("/api/vault-caps/beta", bearer, {
+        method: "PUT",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ cap_bytes: 1.5 }),
+      }),
+      "beta",
+      deps(),
+    );
+    expect(res.status).toBe(400);
+  });
+
+  test("405 on GET", async () => {
+    const bearer = await makeAdminBearer();
+    const res = await handleSetVaultCap(withBearer("/api/vault-caps/beta", bearer), "beta", deps());
+    expect(res.status).toBe(405);
+  });
+
+  test("sets a cap on a registered vault and persists it (upsert)", async () => {
+    const bearer = await makeAdminBearer();
+    const res = await handleSetVaultCap(
+      withBearer("/api/vault-caps/beta", bearer, {
+        method: "PUT",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ cap_bytes: 2 * 1024 * 1024 * 1024 }),
+      }),
+      "beta",
+      deps(),
+    );
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as { vault_cap: { cap_bytes: number } };
+    expect(body.vault_cap.cap_bytes).toBe(2 * 1024 * 1024 * 1024);
+    expect(getVaultCapBytes(harness.db, "beta")).toBe(2 * 1024 * 1024 * 1024);
+  });
+
+  test("400 vault_not_found for a vault not in services.json", async () => {
+    const bearer = await makeAdminBearer();
+    const res = await handleSetVaultCap(
+      withBearer("/api/vault-caps/ghost", bearer, {
+        method: "PUT",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ cap_bytes: 1000 }),
+      }),
+      "ghost",
+      deps(),
+    );
+    expect(res.status).toBe(400);
+    const body = (await res.json()) as { error: string };
+    expect(body.error).toBe("vault_not_found");
+    // Nothing persisted for the rejected name.
+    expect(getVaultCapBytes(harness.db, "ghost")).toBeNull();
+  });
+
+  test("400 on non-positive cap", async () => {
+    const bearer = await makeAdminBearer();
+    const res = await handleSetVaultCap(
+      withBearer("/api/vault-caps/beta", bearer, {
+        method: "PUT",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ cap_bytes: 0 }),
+      }),
+      "beta",
+      deps(),
+    );
+    expect(res.status).toBe(400);
+    const body = (await res.json()) as { error: string };
+    expect(body.error).toBe("invalid_request");
+  });
+});

package/src/__tests__/cli.test.ts

@@ -83,6 +83,26 @@ describe("cli", () => {
     expect(code).toBe(1);
     expect(stderr).toMatch(/unknown command/);
   });
+
+  // hub#693: --hub-origin is persisted to hub_settings.hub_origin and stamps the
+  // OAuth `iss` claim, so the CLI must validate it to the same shape as
+  // `hub set-origin` BEFORE it reaches init() / the DB. These reject at the arg
+  // layer (exit 1) before any daemon work runs.
+  test("init --hub-origin with a path component exits 1", async () => {
+    const { code, stderr } = await runCli([
+      "init",
+      "--hub-origin",
+      "https://host.example/some/path",
+    ]);
+    expect(code).toBe(1);
+    expect(stderr).toMatch(/invalid --hub-origin/);
+  });
+
+  test("init --hub-origin with a non-http(s) scheme exits 1", async () => {
+    const { code, stderr } = await runCli(["init", "--hub-origin", "ftp://bad.example"]);
+    expect(code).toBe(1);
+    expect(stderr).toMatch(/invalid --hub-origin/);
+  });
 });
 
 describe("cli per-subcommand help", () => {