@openparachute/hub 0.7.4-rc.2 → 0.7.4-rc.20

package/src/__tests__/oauth-ui.test.ts

@@ -116,7 +116,8 @@ describe("renderConsent", () => {
     expect(html).toContain("vault:admin");
     // Scope explanations from the registry
     expect(html).toContain("Read your notes");
-    expect(html).toContain("Full vault access");
+    // hub#689 Leg 1: the admin label now enumerates the concrete grants.
+    expect(html).toContain("Read and write everything, plus admin");
   });
 
   test("highlights admin scopes with a danger color and badge", () => {
@@ -252,6 +253,111 @@ describe("renderConsent", () => {
     expect(html).not.toContain("You have no assigned vaults");
     expect(html).not.toContain('value="yes" class="btn btn-primary" disabled');
   });
+
+  // hub#689 — owner-on-own-vault verb selector rendering.
+  test("renders the owner verb selector (read/write/admin), pre-selected to admin", () => {
+    const html = renderConsent({
+      params: { ...PARAMS, scope: "vault:read" },
+      csrfToken: CSRF,
+      clientId: "c",
+      clientName: "App",
+      scopes: ["vault:read"],
+      vaultPicker: { unnamedVerbs: ["read"], availableVaults: ["work"], lockedVault: "work" },
+      ownerVerbSelector: { requestedVerbs: ["read"] },
+    });
+    expect(html).toContain("Access level");
+    expect(html).toContain('name="verb_select" value="read"');
+    expect(html).toContain('name="verb_select" value="write"');
+    expect(html).toContain('name="verb_select" value="admin"');
+    // Admin is the pre-selected (checked) option.
+    expect(html).toMatch(/name="verb_select" value="admin"[^>]*checked/);
+    // read/write are NOT pre-checked.
+    expect(html).not.toMatch(/name="verb_select" value="read"[^>]*checked/);
+    expect(html).not.toMatch(/name="verb_select" value="write"[^>]*checked/);
+  });
+
+  test("owner verb selector keeps the admin option visibly flagged (admin badge + red border)", () => {
+    const html = renderConsent({
+      params: { ...PARAMS, scope: "vault:read" },
+      csrfToken: CSRF,
+      clientId: "c",
+      clientName: "App",
+      scopes: ["vault:read"],
+      vaultPicker: { unnamedVerbs: ["read"], availableVaults: ["work"], lockedVault: "work" },
+      ownerVerbSelector: { requestedVerbs: ["read"] },
+    });
+    // The .scope-admin red-border class + the admin badge ride on the admin
+    // radio option so a pre-selected admin grant stays transparent.
+    expect(html).toContain("verb-option-admin");
+    expect(html).toContain("scope-admin");
+    expect(html).toContain("badge-admin");
+  });
+
+  test("does NOT render the verb selector when ownerVerbSelector is absent (non-owner)", () => {
+    const html = renderConsent({
+      params: { ...PARAMS, scope: "vault:read" },
+      csrfToken: CSRF,
+      clientId: "c",
+      clientName: "App",
+      scopes: ["vault:read"],
+      vaultPicker: { unnamedVerbs: ["read"], availableVaults: ["work"], lockedVault: "work" },
+      // ownerVerbSelector omitted → no selector
+    });
+    expect(html).not.toContain("Access level");
+    expect(html).not.toContain('name="verb_select"');
+  });
+
+  // hub#314 — same-hub vs external trust marker. The `.badge-trust-*` class
+  // names are always present in the inlined <style> block, so assertions target
+  // the RENDERED ELEMENT form (`class="badge badge-trust-*"`) + the copy text,
+  // which only appear in the consent body when the marker actually renders.
+  test("renders the first-party trust marker for a same-hub client", () => {
+    const html = renderConsent({
+      params: PARAMS,
+      csrfToken: CSRF,
+      clientId: "c",
+      clientName: "App",
+      scopes: ["vault:read"],
+      sameHub: true,
+    });
+    expect(html).toContain('class="badge badge-trust-same-hub"');
+    expect(html).toContain(">First-party<");
+    expect(html).toContain("Registered through this hub");
+    // The external badge / copy must NOT appear for a same-hub client.
+    expect(html).not.toContain('class="badge badge-trust-external"');
+    expect(html).not.toContain("third-party app that registered itself");
+  });
+
+  test("renders the external trust marker for a third-party DCR client", () => {
+    const html = renderConsent({
+      params: PARAMS,
+      csrfToken: CSRF,
+      clientId: "c",
+      clientName: "App",
+      scopes: ["vault:read"],
+      sameHub: false,
+    });
+    expect(html).toContain('class="badge badge-trust-external"');
+    expect(html).toContain(">External<");
+    expect(html).toContain("third-party app that registered itself");
+    // The first-party badge / copy must NOT appear for an external client.
+    expect(html).not.toContain('class="badge badge-trust-same-hub"');
+    expect(html).not.toContain("Registered through this hub");
+  });
+
+  test("renders no trust marker when provenance is unknown (sameHub omitted)", () => {
+    const html = renderConsent({
+      params: PARAMS,
+      csrfToken: CSRF,
+      clientId: "c",
+      clientName: "App",
+      scopes: ["vault:read"],
+      // sameHub omitted → undefined → no badge
+    });
+    expect(html).not.toContain('class="trust-marker');
+    expect(html).not.toContain('class="badge badge-trust-same-hub"');
+    expect(html).not.toContain('class="badge badge-trust-external"');
+  });
 });
 
 describe("renderError", () => {

package/src/__tests__/scope-explanations.test.ts

@@ -29,6 +29,25 @@ describe("SCOPE_EXPLANATIONS", () => {
     }
   });
 
+  // hub#689 Leg 1: the vault:admin consent copy must enumerate what
+  // admin actually grants (config/settings, triggers/automation, GitHub
+  // backup, token minting) on top of read/write — so the consent screen
+  // is honest about the admin blast radius, not a vague "configuration
+  // changes" hand-wave.
+  test("vault:admin label enumerates the concrete admin grants (hub#689 Leg 1)", () => {
+    const label = SCOPE_EXPLANATIONS["vault:admin"]?.label ?? "";
+    const lower = label.toLowerCase();
+    expect(SCOPE_EXPLANATIONS["vault:admin"]?.level).toBe("admin");
+    // Read + write are still part of what admin grants.
+    expect(lower).toContain("read");
+    expect(lower).toContain("write");
+    // The four enumerated admin powers.
+    expect(lower).toContain("config");
+    expect(lower).toContain("trigger");
+    expect(lower).toContain("github");
+    expect(lower).toContain("token");
+  });
+
   test("FIRST_PARTY_SCOPES is sorted and matches the keys of SCOPE_EXPLANATIONS", () => {
     expect(FIRST_PARTY_SCOPES).toEqual([...FIRST_PARTY_SCOPES].sort());
     expect(new Set(FIRST_PARTY_SCOPES)).toEqual(new Set(Object.keys(SCOPE_EXPLANATIONS)));

package/src/__tests__/setup-gate.test.ts

@@ -31,6 +31,7 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { hubDbPath, openHubDb } from "../hub-db.ts";
 import { hubFetch } from "../hub-server.ts";
+import { setRootRedirect, setSetting } from "../hub-settings.ts";
 import { writeManifest } from "../services-manifest.ts";
 import { createUser } from "../users.ts";
 
@@ -101,9 +102,7 @@ describe("setup gate (no admin yet)", () => {
   test("/login POST still 503s setup_required when no admin exists (hub#644)", async () => {
     const db = openHubDb(hubDbPath(h.dir));
     try {
-      const res = await hubFetch(h.dir, { getDb: () => db })(
-        req("/login", { method: "POST" }),
-      );
+      const res = await hubFetch(h.dir, { getDb: () => db })(req("/login", { method: "POST" }));
       expect(res.status).toBe(503);
       const body = (await res.json()) as Record<string, unknown>;
       expect(body.error).toBe("setup_required");
@@ -368,3 +367,112 @@ describe("setup gate (admin exists)", () => {
     }
   });
 });
+
+describe("configurable bare-`/` redirect target", () => {
+  let h: Harness;
+  beforeEach(() => {
+    h = makeHarness();
+  });
+  afterEach(() => h.cleanup());
+
+  /** A set-up hub (admin + vault) so the bare-`/` redirect is reached. */
+  function setUpHub(db: ReturnType<typeof openHubDb>): void {
+    writeManifest(
+      {
+        services: [
+          {
+            name: "parachute-vault",
+            version: "0.1.0",
+            port: 1940,
+            paths: ["/vault/default"],
+            health: "/health",
+          },
+        ],
+      },
+      join(h.dir, "services.json"),
+    );
+  }
+
+  function handler(db: ReturnType<typeof openHubDb>) {
+    return hubFetch(h.dir, { getDb: () => db, manifestPath: join(h.dir, "services.json") });
+  }
+
+  test("a configured root_redirect retargets the bare-`/` 302", async () => {
+    const db = openHubDb(hubDbPath(h.dir));
+    try {
+      await createUser(db, "owner", "pw");
+      setUpHub(db);
+      setRootRedirect(db, "/surface/reading-room");
+      const res = await handler(db)(req("/"));
+      expect(res.status).toBe(302);
+      expect(res.headers.get("location")).toBe("/surface/reading-room");
+    } finally {
+      db.close();
+    }
+  });
+
+  test("an unsafe stored root_redirect falls back to /admin (never an open redirect)", async () => {
+    const db = openHubDb(hubDbPath(h.dir));
+    try {
+      await createUser(db, "owner", "pw");
+      setUpHub(db);
+      // A hand-edited sqlite row that bypassed write-side validation.
+      setSetting(db, "root_redirect", "//evil.com");
+      const res = await handler(db)(req("/"));
+      expect(res.status).toBe(302);
+      expect(res.headers.get("location")).toBe("/admin");
+    } finally {
+      db.close();
+    }
+  });
+
+  test("PARACHUTE_HUB_ROOT_REDIRECT env retargets the bare-`/` 302 (no DB row)", async () => {
+    const db = openHubDb(hubDbPath(h.dir));
+    const prev = process.env.PARACHUTE_HUB_ROOT_REDIRECT;
+    process.env.PARACHUTE_HUB_ROOT_REDIRECT = "/surface/from-env";
+    try {
+      await createUser(db, "owner", "pw");
+      setUpHub(db);
+      const res = await handler(db)(req("/"));
+      expect(res.status).toBe(302);
+      expect(res.headers.get("location")).toBe("/surface/from-env");
+    } finally {
+      // Restore process.env to its pre-test state. `delete` (not assign-undefined,
+      // which would coerce to the string "undefined") removes a key we added.
+      if (prev === undefined) {
+        // biome-ignore lint/performance/noDelete: env-key cleanup, not a hot path
+        delete process.env.PARACHUTE_HUB_ROOT_REDIRECT;
+      } else {
+        process.env.PARACHUTE_HUB_ROOT_REDIRECT = prev;
+      }
+      db.close();
+    }
+  });
+
+  test("wizard funnel WINS: a configured root_redirect does NOT bypass setup on a fresh hub", async () => {
+    const db = openHubDb(hubDbPath(h.dir));
+    try {
+      // No admin yet → not-set-up hub. Even with a surface configured, the
+      // bare-`/` must funnel to the wizard, not a surface that can't work yet.
+      setRootRedirect(db, "/surface/reading-room");
+      const res = await handler(db)(req("/"));
+      expect(res.status).toBe(302);
+      expect(res.headers.get("location")).toBe("/admin/setup");
+    } finally {
+      db.close();
+    }
+  });
+
+  test("default is unchanged: bare-`/` → /admin when nothing is configured", async () => {
+    const db = openHubDb(hubDbPath(h.dir));
+    try {
+      await createUser(db, "owner", "pw");
+      setUpHub(db);
+      const res = await handler(db)(req("/"));
+      expect(res.status).toBe(302);
+      expect(res.headers.get("location")).toBe("/admin");
+    } finally {
+      db.close();
+    }
+  });
+});

package/src/__tests__/setup-wizard.test.ts

@@ -990,6 +990,123 @@ describe("handleSetupGet", () => {
       db.close();
     }
   });
+
+  // hub#618: gate the JSON `?op=` op-snapshot once setup is complete.
+  // Mid-setup it stays OPEN (the unauth CLI wizard + brand-new-operator
+  // browser both poll it before any session exists); post-complete it
+  // requires a session or loopback (it's a post-setup admin surface, and
+  // `/admin/setup` is always lockout-exempt so it's otherwise unauth-reachable).
+
+  test("mid-setup unauth ?op= still returns the op snapshot (hub#618 regression guard)", async () => {
+    const db = openHubDb(hubDbPath(h.dir));
+    try {
+      // No admin yet → setup INCOMPLETE → the surface stays open.
+      const reg = getDefaultOperationsRegistry();
+      const op = reg.create("install", "vault");
+      reg.update(op.id, { status: "running" }, "running bun add -g @openparachute/vault@latest");
+      const res = handleSetupGet(
+        req(`/admin/setup?op=${op.id}`, { headers: { accept: "application/json" } }),
+        {
+          db,
+          manifestPath: h.manifestPath,
+          configDir: h.dir,
+          readExposeStateFn: h.readExposeStateFn,
+          issuer: "https://hub.example",
+          registry: reg,
+          // No loopback flag, no session — the unauth first-boot poll.
+        },
+      );
+      expect(res.status).toBe(200);
+      const body = (await res.json()) as {
+        hasAdmin: boolean;
+        operation?: { id: string; status: string; log: readonly string[] };
+      };
+      expect(body.hasAdmin).toBe(false);
+      expect(body.operation).toBeDefined();
+      expect(body.operation?.id).toBe(op.id);
+      expect(body.operation?.status).toBe("running");
+    } finally {
+      db.close();
+    }
+  });
+
+  test("post-complete unauth ?op= omits the op snapshot; session OR loopback restores it (hub#618)", async () => {
+    const db = openHubDb(hubDbPath(h.dir));
+    try {
+      // Drive state to COMPLETE: admin + vault + expose mode.
+      const user = await createUser(db, "owner", "pw");
+      writeManifest(
+        {
+          services: [
+            {
+              name: "parachute-vault",
+              version: "0.1.0",
+              port: 1940,
+              paths: ["/vault/default"],
+              health: "/health",
+            },
+          ],
+        },
+        h.manifestPath,
+      );
+      setSetting(db, "setup_expose_mode", "localhost");
+      const reg = getDefaultOperationsRegistry();
+      const op = reg.create("install", "vault");
+      reg.update(op.id, { status: "running" }, "still running");
+
+      const deps = {
+        db,
+        manifestPath: h.manifestPath,
+        configDir: h.dir,
+        readExposeStateFn: h.readExposeStateFn,
+        issuer: "https://hub.example",
+        registry: reg,
+      };
+
+      // (a) Unauth, non-loopback → operation omitted.
+      const unauth = handleSetupGet(
+        req(`/admin/setup?op=${op.id}`, { headers: { accept: "application/json" } }),
+        deps,
+      );
+      expect(unauth.status).toBe(200);
+      const unauthBody = (await unauth.json()) as {
+        hasAdmin: boolean;
+        hasVault: boolean;
+        hasExposeMode: boolean;
+        operation?: unknown;
+      };
+      // Confirm setup actually derived as complete (else the gate is vacuous).
+      expect(unauthBody.hasAdmin).toBe(true);
+      expect(unauthBody.hasVault).toBe(true);
+      expect(unauthBody.hasExposeMode).toBe(true);
+      expect(unauthBody.operation).toBeUndefined();
+
+      // (b) Valid session → operation restored.
+      const { createSession } = await import("../sessions.ts");
+      const session = createSession(db, { userId: user.id });
+      const authed = handleSetupGet(
+        req(`/admin/setup?op=${op.id}`, {
+          headers: {
+            accept: "application/json",
+            cookie: `${SESSION_COOKIE_NAME}=${session.id}`,
+          },
+        }),
+        deps,
+      );
+      const authedBody = (await authed.json()) as { operation?: { id: string } };
+      expect(authedBody.operation?.id).toBe(op.id);
+
+      // (c) Loopback (no session) → operation restored.
+      const loopback = handleSetupGet(
+        req(`/admin/setup?op=${op.id}`, { headers: { accept: "application/json" } }),
+        { ...deps, requestIsLoopback: true },
+      );
+      const loopbackBody = (await loopback.json()) as { operation?: { id: string } };
+      expect(loopbackBody.operation?.id).toBe(op.id);
+    } finally {
+      db.close();
+    }
+  });
 });
 
 // --- POST /admin/setup/account -------------------------------------------
@@ -3150,7 +3267,7 @@ describe("typed vault name (hub#267)", () => {
     }
   });
 
-  test("vault POST with empty name falls back to 'default' + omits the env override", async () => {
+  test("vault POST with empty name falls back to 'default' + ALWAYS passes PARACHUTE_VAULT_NAME (#478 Part 2)", async () => {
     const db = openHubDb(hubDbPath(h.dir));
     try {
       const user = await createUser(db, "owner", "pw");
@@ -3213,12 +3330,12 @@ describe("typed vault name (hub#267)", () => {
       await new Promise((r) => setTimeout(r, 50));
       const vaultSpawn = spawnRequests.find((s) => s.short === "vault");
       expect(vaultSpawn).toBeDefined();
-      // No PARACHUTE_VAULT_NAME override on the default-name path (vault's
-      // resolveFirstBootVaultName already defaults to "default" when the
-      // env var is absent). PORT is set by the supervisor (hub#356) for
-      // every supervised child regardless — assert the empty-name path
-      // doesn't add PARACHUTE_VAULT_NAME.
-      expect(vaultSpawn?.env?.PARACHUTE_VAULT_NAME).toBeUndefined();
+      // #478 Part 2: wizard ALWAYS passes PARACHUTE_VAULT_NAME so vault's
+      // first-boot knows which vault to create once silent auto-create is
+      // removed. Even for the default name, the env var must be set to
+      // "default" — not omitted. PORT is set by the supervisor (hub#356)
+      // for every supervised child regardless.
+      expect(vaultSpawn?.env?.PARACHUTE_VAULT_NAME).toBe("default");
       expect(vaultSpawn?.env?.PORT).toBe("1940");
     } finally {
       db.close();

package/src/__tests__/supervisor.test.ts

@@ -1591,6 +1591,31 @@ describe("Supervisor port-readiness + structured start-error (§6.5)", () => {
     expect(spawner.calls).toHaveLength(0);
   });
 
+  test("(#634) preflight non-executable binary → non_executable start-error, NO spawn", async () => {
+    const spawner = makeQueueSpawner();
+    const sup = new Supervisor({
+      spawnFn: spawner.spawn,
+      killFn: noopKill,
+      // `which` requires X_OK so it returns null for a 100644 bin...
+      which: () => null,
+      // ...but the secondary probe finds it present-but-non-executable.
+      findNonExecutable: () => "/x/vault/bin/parachute-vault",
+      portListening: async () => true,
+      startReadyMs: 50,
+      sleep: () => Promise.resolve(),
+    });
+    const state = await sup.start(reqWithPort("vault", 1940));
+
+    expect(state.status).toBe("crashed");
+    expect(state.startError?.error_type).toBe("non_executable");
+    expect(state.startError?.error_description).toContain(
+      "but is not executable — run chmod +x /x/vault/bin/parachute-vault",
+    );
+    // No misleading "not installed" install card, and never spawned.
+    expect(state.startError?.binary).toBe("parachute-vault");
+    expect(spawner.calls).toHaveLength(0);
+  });
+
   test("a clean re-start clears a prior started-but-unbound start-error", async () => {
     const first = makeFakeProc(201);
     const second = makeFakeProc(202);

package/src/__tests__/vault-names.test.ts

@@ -68,11 +68,16 @@ describe("listVaultNames", () => {
     expect(listVaultNames(manifest)).toEqual(["personal", "work"]);
   });
 
-  test("entry with no paths falls back to the manifest-suffix name (hub#143)", () => {
+  test("#478: bare empty-paths `parachute-vault` row yields NO name (no phantom 'default')", () => {
+    // What vault's self-register emits at zero vaults: the row stays present
+    // (installed-detection) but advertises no `/vault/<name>` path. It must not
+    // leak a selectable/assignable "default" before any vault exists. Mirrors
+    // the empty-paths skip in admin-vaults.ts (findExistingVault /
+    // listVaultInstanceNames).
     const manifest: ServicesManifest = {
       services: [
         {
-          name: "parachute-vault-archived",
+          name: "parachute-vault",
           port: 1940,
           paths: [],
           health: "/h",
@@ -80,7 +85,31 @@ describe("listVaultNames", () => {
         },
       ],
     };
-    expect(listVaultNames(manifest)).toEqual(["archived"]);
+    expect(listVaultNames(manifest)).toEqual([]);
+  });
+
+  test("#478: empty-paths row is skipped; real-paths vault rows are unchanged (positive control)", () => {
+    // An empty-paths row alongside a real-paths row: the real instance still
+    // resolves, the empty one contributes nothing.
+    const manifest: ServicesManifest = {
+      services: [
+        {
+          name: "parachute-vault",
+          port: 1940,
+          paths: [],
+          health: "/h",
+          version: "0.1.0",
+        },
+        {
+          name: "parachute-vault-work",
+          port: 1941,
+          paths: ["/vault/work"],
+          health: "/h",
+          version: "0.1.0",
+        },
+      ],
+    };
+    expect(listVaultNames(manifest)).toEqual(["work"]);
   });
 
   test("deduplicates collisions across single-entry + per-vault shapes", () => {

package/src/__tests__/vault-remove.test.ts

@@ -83,6 +83,7 @@ const SUCCESS_BODY = {
     grants_dropped: 2,
     user_vaults_removed: 4,
     invites_invalidated: 1,
+    vault_cap_removed: true,
     connections_torn_down: 1,
     orphaned_channels: [],
     vault_removed: true,
@@ -156,6 +157,7 @@ describe("vaultRemove — 200 success", () => {
     expect(text).toContain("3");
     expect(text).toContain("user_vaults removed:");
     expect(text).toContain("4");
+    expect(text).toContain("storage cap removed:");
     expect(text).toContain("vault removed:");
   });
 
@@ -194,19 +196,35 @@ describe("vaultRemove — 200 success", () => {
   });
 });
 
-describe("vaultRemove — 409 last_vault GUARDRAIL", () => {
-  test("returns NON-ZERO and NEVER spawns parachute-vault", async () => {
+describe("vaultRemove — last vault (#678: cascade-then-delete, no 409)", () => {
+  test("the last vault deletes via the cascade (200) and NEVER spawns parachute-vault directly", async () => {
     await withSpawnSpy(async (spawned) => {
-      const { fetch, calls } = fakeFetch([
-        {
-          status: 409,
-          body: {
-            error: "last_vault",
-            error_description:
-              '"scratch" is the last vault on this hub. Create another vault first, or use the CLI.',
-          },
+      // The endpoint no longer refuses the last vault — it returns 200 with the
+      // cascade summary, identical to any other delete. The CLI just renders it.
+      const lastVaultBody = {
+        ok: true,
+        name: "scratch",
+        cascade: {
+          tokens_revoked: 2,
+          grants_rewritten: 0,
+          grants_dropped: 1,
+          user_vaults_removed: 1,
+          invites_invalidated: 0,
+          vault_cap_removed: true,
+          connections_torn_down: 0,
+          orphaned_channels: [],
+          vault_removed: true,
+          module_restarted: true,
         },
-      ]);
+        warnings: [
+          {
+            step: "last_vault",
+            detail:
+              "the deleted vault was the last one on this hub — no vaults remain. The vault CLI wrote auto_create: false, so boot won't recreate a default vault. Create one with: parachute-vault create <name>",
+          },
+        ],
+      };
+      const { fetch, calls } = fakeFetch([{ status: 200, body: lastVaultBody }]);
       const sinks = makeSinks();
       const code = await vaultRemove(["scratch"], {
         resolveBearer: async () => BEARER,
@@ -214,17 +232,20 @@ describe("vaultRemove — 409 last_vault GUARDRAIL", () => {
         log: sinks.log,
         logError: sinks.logError,
       });
-      // Non-zero exit.
-      expect(code).not.toBe(0);
-      // Exactly ONE fetch (the DELETE) — no fall-through retry path.
+      // 200 → success exit; the cascade did its work.
+      expect(code).toBe(0);
+      // Exactly ONE fetch (the DELETE) — the cascade runs server-side over loopback.
       expect(calls).toHaveLength(1);
       expect(calls[0]?.method).toBe("DELETE");
-      // The load-bearing invariant: no `parachute-vault` spawn.
+      // The load-bearing invariant still holds: the CLI never spawns
+      // `parachute-vault` itself — destruction goes through the hub endpoint.
       expect(spawned.count).toBe(0);
-      // Surfaces the endpoint message + the cascade-skip warning on the escape hatch.
-      const errText = sinks.errText();
-      expect(errText).toContain("last vault");
-      expect(errText).toContain("SKIPS the identity cascade");
+      // The cascade summary renders, including the last_vault heads-up warning.
+      const text = sinks.text();
+      expect(text).toContain("tokens revoked:");
+      expect(text).toContain("vault removed:");
+      expect(text).toContain("last_vault");
+      expect(text).toContain("auto_create: false");
     });
   });
 });

package/src/__tests__/well-known.test.ts

@@ -472,13 +472,48 @@ describe("buildWellKnown", () => {
     );
   });
 
-  test("falls back to / for empty paths", () => {
+  test("an empty-paths VAULT row is skipped entirely — no phantom default (#478)", () => {
+    // A vault services row with `paths: []` means "module installed but no
+    // servable vault instance" (vault's self-register emits this at zero
+    // vaults). It must NOT fabricate a vault entry at root in either the
+    // `vaults` array or the flat `services` catalog. Mirrors the empty-paths
+    // skip in admin-vaults.ts / vault-names.ts / oauth-handlers.ts.
     const entry: ServiceEntry = { ...vault, paths: [] };
     const doc = buildWellKnown({
       services: [entry],
       canonicalOrigin: "https://x.example",
     });
-    expect(doc.vaults[0]?.url).toBe("https://x.example/");
+    expect(doc.vaults).toEqual([]);
+    // The row contributes nothing to the flat services list either — no
+    // phantom `/` mount advertised.
+    expect(doc.services).toEqual([]);
+  });
+
+  test("positive control: a vault row WITH a path still emits its vault + services entries (#478)", () => {
+    const doc = buildWellKnown({
+      services: [{ ...vault, paths: ["/vault/default"] }],
+      canonicalOrigin: "https://x.example",
+    });
+    expect(doc.vaults).toEqual([
+      {
+        name: "default",
+        url: "https://x.example/vault/default",
+        version: "0.2.4",
+      },
+    ]);
+    expect(doc.services.map((s) => s.name)).toEqual(["parachute-vault"]);
+  });
+
+  test("a NON-vault row with empty paths still falls back to / (#478 scope guard)", () => {
+    // The empty-paths skip is vault-only. A non-vault service legitimately
+    // mounts at root when path-less — that behavior is unchanged.
+    const entry: ServiceEntry = { ...notes, paths: [] };
+    const doc = buildWellKnown({
+      services: [entry],
+      canonicalOrigin: "https://x.example",
+    });
+    expect(doc.services.map((s) => s.path)).toEqual(["/"]);
+    expect(doc.notes).toEqual([{ url: "https://x.example/", version: "0.0.1" }]);
   });
 
   // Hierarchical sub-units (hub#313 — parachute-app design doc §12). Each