@openparachute/hub 0.7.4-rc.13 → 0.7.4-rc.14

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openparachute/hub",
-  "version": "0.7.4-rc.13",
+  "version": "0.7.4-rc.14",
   "description": "parachute — the local hub for the Parachute ecosystem (discovery, ports, lifecycle, soon OAuth).",
   "license": "AGPL-3.0",
   "publishConfig": {

package/src/__tests__/admin-lock.test.ts

@@ -527,7 +527,13 @@ describe("admin-lock management API", () => {
     const r2 = await handleAdminLock(lockReq("/heartbeat", cookie, {}), "/heartbeat", {
       db: harness.db,
     });
-    expect(((await r2.json()) as { locked: boolean }).locked).toBe(false);
+    const body2 = (await r2.json()) as { locked: boolean; idle_seconds?: number };
+    expect(body2.locked).toBe(false);
+    // The heartbeat MUST carry idle_seconds — the client re-anchors its local
+    // idle timer from it on every heartbeat. Omitting it poisoned the timer
+    // (undefined → NaN → instant re-lock). Regression guard for the PIN
+    // re-prompt loop.
+    expect(body2.idle_seconds).toBe(getIdleSeconds(harness.db));
   });
 
   test("unlock brute-force limiter: 6th attempt is 429", async () => {

package/src/api-admin-lock.ts

@@ -159,8 +159,15 @@ export async function handleAdminLock(
     case "/heartbeat":
       // Slide the idle window forward if (and only if) currently unlocked.
       refreshActivity(gate.sessionId, getIdleSeconds(db), now().getTime());
+      // `idle_seconds` is part of the response so the heartbeat fulfills the
+      // same `AdminLockStatus` shape as GET status — the client re-anchors its
+      // local idle timer from it on every heartbeat, so it MUST be present.
+      // Omitting it poisoned the client timer with `undefined` (→ NaN → instant
+      // re-lock), the bug this fixes. It also lets a live session pick up an
+      // idle-window change the operator made in Settings mid-session.
       return json(200, {
         locked: isLockConfigured(db) && !isSessionUnlocked(gate.sessionId, now().getTime()),
+        idle_seconds: getIdleSeconds(db),
         unlock_seconds_remaining: unlockSecondsRemaining(gate.sessionId, now().getTime()),
       });
     default: