@openparachute/hub 0.7.4-rc.2 → 0.7.4-rc.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openparachute/hub",
-  "version": "0.7.4-rc.2",
+  "version": "0.7.4-rc.4",
   "description": "parachute — the local hub for the Parachute ecosystem (discovery, ports, lifecycle, soon OAuth).",
   "license": "AGPL-3.0",
   "publishConfig": {

package/src/__tests__/clients.test.ts

@@ -151,7 +151,10 @@ describe("expandRedirectUrisForHubOrigins (surface#118 cross-hub-origin DCR expa
   const hubOrigins = [LOOPBACK, "http://localhost:1939", PUBLIC];
 
   test("expands a loopback-rooted URI onto every other hub origin", () => {
-    const out = expandRedirectUrisForHubOrigins([`${LOOPBACK}/surface/notes/oauth/callback`], hubOrigins);
+    const out = expandRedirectUrisForHubOrigins(
+      [`${LOOPBACK}/surface/notes/oauth/callback`],
+      hubOrigins,
+    );
     // Original is preserved + the public + localhost variants are added.
     expect(out).toContain(`${LOOPBACK}/surface/notes/oauth/callback`);
     expect(out).toContain(`${PUBLIC}/surface/notes/oauth/callback`);
@@ -188,10 +191,7 @@ describe("expandRedirectUrisForHubOrigins (surface#118 cross-hub-origin DCR expa
   });
 
   test("single known hub origin → no expansion (submitted set returned as-is)", () => {
-    const out = expandRedirectUrisForHubOrigins(
-      [`${LOOPBACK}/surface/notes/`],
-      [LOOPBACK],
-    );
+    const out = expandRedirectUrisForHubOrigins([`${LOOPBACK}/surface/notes/`], [LOOPBACK]);
     expect(out).toEqual([`${LOOPBACK}/surface/notes/`]);
   });
 
@@ -222,9 +222,9 @@ describe("expandRedirectUrisForHubOrigins (surface#118 cross-hub-origin DCR expa
       const r = registerClient(db, { redirectUris: expanded });
       // The public-origin variant now matches exactly at authorize time — the
       // off-localhost sign-in that surface#118 broke.
-      expect(
-        requireRegisteredRedirectUri(r.client, `${PUBLIC}/surface/notes/oauth/callback`),
-      ).toBe(`${PUBLIC}/surface/notes/oauth/callback`);
+      expect(requireRegisteredRedirectUri(r.client, `${PUBLIC}/surface/notes/oauth/callback`)).toBe(
+        `${PUBLIC}/surface/notes/oauth/callback`,
+      );
       // A truly-unregistered URI is still rejected — strict match unchanged.
       expect(() =>
         requireRegisteredRedirectUri(r.client, "https://evil.example/surface/notes/oauth/callback"),
@@ -352,4 +352,24 @@ describe("isValidRedirectUri", () => {
     expect(isValidRedirectUri("/relative")).toBe(false);
     expect(isValidRedirectUri("not a url")).toBe(false);
   });
+  // hub#663: spec-forbidden shapes that the protocol allowlist alone passed.
+  test("rejects userinfo-bearing redirect URIs (hub#663)", () => {
+    expect(isValidRedirectUri("https://x@evil.com/cb")).toBe(false);
+    expect(isValidRedirectUri("https://user:pass@evil.com/cb")).toBe(false);
+    expect(isValidRedirectUri("http://attacker@127.0.0.1:3000/cb")).toBe(false);
+  });
+  test("rejects control chars in the raw input (hub#663)", () => {
+    // Control chars must be caught on the RAW string — URL parsing would
+    // otherwise strip a trailing \r\n and the smuggled value would pass.
+    expect(isValidRedirectUri("https://example.com/cb\r\nSet-Cookie: x")).toBe(false);
+    expect(isValidRedirectUri("https://example.com/\x00cb")).toBe(false);
+    expect(isValidRedirectUri("https://example.com/cb\x7f")).toBe(false);
+  });
+  test("still accepts clean http(s) with ports, paths, and queries (regression guard)", () => {
+    // Legitimate clients (hub modules, self-built surfaces, Notes, Claude DCR)
+    // all register clean URIs — these must keep passing.
+    expect(isValidRedirectUri("https://claude.ai/api/mcp/auth_callback")).toBe(true);
+    expect(isValidRedirectUri("http://localhost:1939/admin/oauth/callback")).toBe(true);
+    expect(isValidRedirectUri("https://my-surface.github.io/cb?x=1")).toBe(true);
+  });
 });

package/src/__tests__/hub-server.test.ts

@@ -3,10 +3,7 @@ import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
-import {
-  _resetBootstrapTokenForTests,
-  generateBootstrapToken,
-} from "../bootstrap-token.ts";
+import { _resetBootstrapTokenForTests, generateBootstrapToken } from "../bootstrap-token.ts";
 import { buildCsrfCookie, generateCsrfToken } from "../csrf.ts";
 import { HUB_SVC, hubPortPath } from "../hub-control.ts";
 import { createDbHolder } from "../hub-db-liveness.ts";
@@ -3715,7 +3712,9 @@ describe("layerOf — classify trust layer from proxy headers + peer (item E / #
   // flipped an empty XFF back to loopback would re-open the Caddy-direct leak.
   test("loopback peer + empty X-Forwarded-For → public (errs safe, not loopback) [#704]", () => {
     expect(layerOf(req("/", { headers: { "X-Forwarded-For": "" } }), "127.0.0.1")).toBe("public");
-    expect(layerOf(req("/", { headers: { "X-Forwarded-For": "   " } }), "127.0.0.1")).toBe("public");
+    expect(layerOf(req("/", { headers: { "X-Forwarded-For": "   " } }), "127.0.0.1")).toBe(
+      "public",
+    );
   });
 
   // The genuine on-box caller (CLI, health probe, init bootstrap-token loopback
@@ -6090,3 +6089,126 @@ describe("GET /admin/setup bootstrap-token probe — loopback-gated (hub#576 + C
     }
   });
 });
+
+// hub#643 (Tier-1): non-script security headers on proxied module/surface
+// text/html pages. The vault content proxy and the generic services-mount
+// proxy both flow through `decorateWithChrome`, so the headers land on both.
+// DELIBERATELY no `script-src` — a strict script-src would white-screen
+// self-built GitHub-hosted surfaces + inline-script module pages (that's the
+// deferred Tier-2). Header-only: non-HTML proxied responses are NOT decorated.
+describe("hubFetch proxied-page security headers (hub#643 Tier-1)", () => {
+  const TIER1_CSP = "frame-ancestors 'self'; object-src 'none'; base-uri 'self'";
+
+  // Live upstream that echoes a fixed content-type + body so the test can
+  // exercise both the text/html (decorated) and JSON (untouched) branches.
+  function startUpstream(contentType: string, body: string): { port: number; stop: () => void } {
+    const server = Bun.serve({
+      port: 0,
+      hostname: "127.0.0.1",
+      fetch: () => new Response(body, { status: 200, headers: { "content-type": contentType } }),
+    });
+    return { port: server.port as number, stop: () => server.stop(true) };
+  }
+
+  test("decorates a proxied text/html generic-mount page with nosniff + the Tier-1 CSP", async () => {
+    const h = makeHarness();
+    const upstream = startUpstream(
+      "text/html; charset=utf-8",
+      "<html><body><h1>my surface</h1></body></html>",
+    );
+    try {
+      writeManifest(
+        {
+          services: [
+            {
+              name: "parachute-surface",
+              port: upstream.port,
+              paths: ["/surface"],
+              health: "/surface/health",
+              version: "0.2.0",
+            },
+          ],
+        },
+        h.manifestPath,
+      );
+      const res = await hubFetch(h.dir, { manifestPath: h.manifestPath })(req("/surface/foo"));
+      expect(res.status).toBe(200);
+      expect(res.headers.get("content-type")).toContain("text/html");
+      expect(res.headers.get("x-content-type-options")).toBe("nosniff");
+      const csp = res.headers.get("content-security-policy");
+      expect(csp).toBe(TIER1_CSP);
+      // The critical Tier-1/Tier-2 boundary: NO script-src — self-built
+      // GitHub-hosted surfaces + inline-script module pages must stay
+      // unrestricted. A strict script-src is the deferred Tier-2.
+      expect(csp).not.toContain("script-src");
+    } finally {
+      upstream.stop();
+      h.cleanup();
+    }
+  });
+
+  test("decorates a proxied text/html per-vault page (the Notes-PWA path) with the same headers", async () => {
+    const h = makeHarness();
+    const upstream = startUpstream("text/html; charset=utf-8", "<html><body>notes</body></html>");
+    try {
+      writeManifest(
+        {
+          services: [
+            {
+              name: "parachute-vault",
+              port: upstream.port,
+              paths: ["/vault/default"],
+              health: "/vault/default/health",
+              version: "0.4.0",
+            },
+          ],
+        },
+        h.manifestPath,
+      );
+      const res = await hubFetch(h.dir, { manifestPath: h.manifestPath })(
+        req("/vault/default/some-page"),
+      );
+      expect(res.status).toBe(200);
+      expect(res.headers.get("x-content-type-options")).toBe("nosniff");
+      expect(res.headers.get("content-security-policy")).toBe(TIER1_CSP);
+      expect(res.headers.get("content-security-policy")).not.toContain("script-src");
+    } finally {
+      upstream.stop();
+      h.cleanup();
+    }
+  });
+
+  test("leaves a proxied NON-HTML response (JSON) undecorated", async () => {
+    const h = makeHarness();
+    const upstream = startUpstream("application/json", JSON.stringify({ ok: true }));
+    try {
+      writeManifest(
+        {
+          services: [
+            {
+              name: "parachute-surface",
+              port: upstream.port,
+              paths: ["/surface"],
+              health: "/surface/health",
+              version: "0.2.0",
+            },
+          ],
+        },
+        h.manifestPath,
+      );
+      const res = await hubFetch(h.dir, { manifestPath: h.manifestPath })(req("/surface/api/data"));
+      expect(res.status).toBe(200);
+      expect(res.headers.get("content-type")).toContain("application/json");
+      // No HTML CSP on a JSON API response (proves the header is gated on
+      // content-type, so a `.js` asset proxied through the same path is also
+      // left alone).
+      expect(res.headers.get("content-security-policy")).toBeNull();
+      expect(res.headers.get("x-content-type-options")).toBeNull();
+      const body = (await res.json()) as { ok: boolean };
+      expect(body.ok).toBe(true);
+    } finally {
+      upstream.stop();
+      h.cleanup();
+    }
+  });
+});

package/src/__tests__/oauth-handlers.test.ts

@@ -9899,3 +9899,422 @@ describe("single OAuth consent + grantable vault admin + delegate-only cap (2026
     }
   });
 });
+
+// ───────────────────────────────────────────────────────────────────────────
+// hub#689 — owner-on-own-vault VERB SELECTOR. The consent screen offers an
+// owner of the picked vault a read/write/admin selector (pre-selected to
+// admin) when the client requested an UNNAMED `vault:read`/`vault:write`. On
+// submit, the owner's selection widens the unnamed verb to the chosen level
+// on the picked vault — BEFORE `capScopesToUserAuthority`, which remains the
+// backstop. The selector value is an UNTRUSTED hint: the handler re-derives
+// ownership of the picked vault server-side, and the cap drops any verb the
+// user doesn't actually hold.
+// ───────────────────────────────────────────────────────────────────────────
+describe("hub#689 — owner-on-own-vault verb selector + widening", () => {
+  const TTL_S = Math.floor(SESSION_TTL_MS / 1000);
+  const SEL_MANIFEST: ServicesManifest = {
+    services: [
+      {
+        name: "parachute-vault",
+        port: 1940,
+        paths: ["/vault/work", "/vault/other"],
+        health: "/health",
+        version: "0.7.0",
+      },
+    ],
+  };
+  const selDeps = {
+    issuer: ISSUER,
+    loadServicesManifest: () => SEL_MANIFEST,
+    hubBoundOrigins: () => [ISSUER],
+  };
+
+  async function submitConsent(
+    db: Awaited<ReturnType<typeof makeDb>>["db"],
+    sessionId: string,
+    clientId: string,
+    scope: string,
+    challenge: string,
+    extra: Record<string, string> = {},
+  ): Promise<Response> {
+    const form = new URLSearchParams({
+      __action: "consent",
+      __csrf: TEST_CSRF,
+      approve: "yes",
+      client_id: clientId,
+      redirect_uri: "https://app.example/cb",
+      response_type: "code",
+      scope,
+      code_challenge: challenge,
+      code_challenge_method: "S256",
+      ...extra,
+    });
+    return handleAuthorizePost(
+      db,
+      new Request(`${ISSUER}/oauth/authorize`, {
+        method: "POST",
+        body: form,
+        headers: {
+          "content-type": "application/x-www-form-urlencoded",
+          cookie: `${CSRF_COOKIE}; ${buildSessionCookie(sessionId, TTL_S)}`,
+        },
+      }),
+      selDeps,
+    );
+  }
+
+  async function redeemScope(
+    db: Awaited<ReturnType<typeof makeDb>>["db"],
+    code: string,
+    clientId: string,
+    verifier: string,
+  ): Promise<string> {
+    const tokenRes = await handleToken(
+      db,
+      new Request(`${ISSUER}/oauth/token`, {
+        method: "POST",
+        body: new URLSearchParams({
+          grant_type: "authorization_code",
+          code,
+          client_id: clientId,
+          redirect_uri: "https://app.example/cb",
+          code_verifier: verifier,
+        }),
+        headers: { "content-type": "application/x-www-form-urlencoded" },
+      }),
+      selDeps,
+    );
+    expect(tokenRes.status).toBe(200);
+    const body = (await tokenRes.json()) as { scope: string };
+    return body.scope;
+  }
+
+  // GET render: owner of the picked vault sees the selector. A non-admin
+  // assigned to exactly one vault gets the locked picker → the selector is
+  // offered (they hold admin on their assigned vault).
+  test("selector RENDERED for an owner (assigned user) of the picked vault", async () => {
+    const { db, cleanup } = await makeDb();
+    try {
+      await createUser(db, "owner", "pw"); // consumes the admin slot
+      const friend = await createUser(db, "friend", "pw", { allowMulti: true });
+      setUserVaults(db, friend.id, ["work"]); // role=write → holds admin on "work"
+      const session = createSession(db, { userId: friend.id });
+      const reg = registerClient(db, {
+        redirectUris: ["https://app.example/cb"],
+        status: "approved",
+      });
+      const { challenge } = makePkce();
+      const res = handleAuthorizeGet(
+        db,
+        new Request(
+          authorizeUrl({
+            client_id: reg.client.clientId,
+            redirect_uri: "https://app.example/cb",
+            response_type: "code",
+            code_challenge: challenge,
+            code_challenge_method: "S256",
+            scope: "vault:read",
+          }),
+          { headers: { cookie: `${CSRF_COOKIE}; ${buildSessionCookie(session.id, TTL_S)}` } },
+        ),
+        selDeps,
+      );
+      expect(res.status).toBe(200);
+      const html = await res.text();
+      expect(html).toContain("Access level");
+      expect(html).toContain('name="verb_select"');
+      // Admin pre-selected, still visibly flagged.
+      expect(html).toMatch(/name="verb_select" value="admin"[^>]*checked/);
+      expect(html).toContain("badge-admin");
+    } finally {
+      cleanup();
+    }
+  });
+
+  // GET render: a read-only-assigned user (role=read → holds read, NOT admin)
+  // does NOT see the selector — offering admin pre-selected would promise an
+  // upgrade the cap silently demotes. They hold the vault but not admin on it.
+  test("selector NOT rendered for a read-only-assigned user (holds read, not admin)", async () => {
+    const { db, cleanup } = await makeDb();
+    try {
+      await createUser(db, "owner", "pw");
+      const reader = await createUser(db, "reader", "pw", { allowMulti: true });
+      // role=read directly (setUserVaults hardcodes write) → holds read only.
+      db.prepare(
+        "INSERT INTO user_vaults (user_id, vault_name, role, created_at) VALUES (?, ?, 'read', ?)",
+      ).run(reader.id, "work", new Date().toISOString());
+      const session = createSession(db, { userId: reader.id });
+      const reg = registerClient(db, {
+        redirectUris: ["https://app.example/cb"],
+        status: "approved",
+      });
+      const { challenge } = makePkce();
+      const res = handleAuthorizeGet(
+        db,
+        new Request(
+          authorizeUrl({
+            client_id: reg.client.clientId,
+            redirect_uri: "https://app.example/cb",
+            response_type: "code",
+            code_challenge: challenge,
+            code_challenge_method: "S256",
+            scope: "vault:read",
+          }),
+          { headers: { cookie: `${CSRF_COOKIE}; ${buildSessionCookie(session.id, TTL_S)}` } },
+        ),
+        selDeps,
+      );
+      expect(res.status).toBe(200);
+      const html = await res.text();
+      expect(html).not.toContain("Access level");
+      expect(html).not.toContain('name="verb_select"');
+    } finally {
+      cleanup();
+    }
+  });
+
+  // GET render: a non-owner (non-admin with ZERO assigned vaults) does NOT
+  // see the selector — they can't authorize a vault scope at all.
+  test("selector NOT rendered for a non-owner (zero-vault non-admin)", async () => {
+    const { db, cleanup } = await makeDb();
+    try {
+      await createUser(db, "owner", "pw");
+      const stranger = await createUser(db, "stranger", "pw", { allowMulti: true });
+      // No setUserVaults → zero assignments → not an owner of anything.
+      const session = createSession(db, { userId: stranger.id });
+      const reg = registerClient(db, {
+        redirectUris: ["https://app.example/cb"],
+        status: "approved",
+      });
+      const { challenge } = makePkce();
+      const res = handleAuthorizeGet(
+        db,
+        new Request(
+          authorizeUrl({
+            client_id: reg.client.clientId,
+            redirect_uri: "https://app.example/cb",
+            response_type: "code",
+            code_challenge: challenge,
+            code_challenge_method: "S256",
+            scope: "vault:read",
+          }),
+          { headers: { cookie: `${CSRF_COOKIE}; ${buildSessionCookie(session.id, TTL_S)}` } },
+        ),
+        selDeps,
+      );
+      expect(res.status).toBe(200);
+      const html = await res.text();
+      expect(html).not.toContain("Access level");
+      expect(html).not.toContain('name="verb_select"');
+    } finally {
+      cleanup();
+    }
+  });
+
+  // Submit: owner (first admin) + client requested unnamed vault:read + selects
+  // admin → minted vault:<picked>:admin. THE core bug fix.
+  test("owner selects admin on an unnamed vault:read → minted vault:work:admin", async () => {
+    const { db, cleanup } = await makeDb();
+    try {
+      const owner = await createUser(db, "owner", "pw"); // first admin
+      const session = createSession(db, { userId: owner.id });
+      const reg = registerClient(db, {
+        redirectUris: ["https://app.example/cb"],
+        status: "approved",
+      });
+      const { verifier, challenge } = makePkce();
+      const res = await submitConsent(
+        db,
+        session.id,
+        reg.client.clientId,
+        "vault:read",
+        challenge,
+        {
+          vault_pick: "work",
+          verb_select: "admin",
+        },
+      );
+      expect(res.status).toBe(302);
+      const code = new URL(res.headers.get("location") ?? "").searchParams.get("code");
+      expect(code).toBeTruthy();
+      const scope = await redeemScope(db, code ?? "", reg.client.clientId, verifier);
+      expect(scope).toBe("vault:work:admin");
+    } finally {
+      cleanup();
+    }
+  });
+
+  // Submit: owner selects write → vault:<picked>:write.
+  test("owner selects write on an unnamed vault:read → minted vault:work:write", async () => {
+    const { db, cleanup } = await makeDb();
+    try {
+      const owner = await createUser(db, "owner", "pw");
+      const session = createSession(db, { userId: owner.id });
+      const reg = registerClient(db, {
+        redirectUris: ["https://app.example/cb"],
+        status: "approved",
+      });
+      const { verifier, challenge } = makePkce();
+      const res = await submitConsent(
+        db,
+        session.id,
+        reg.client.clientId,
+        "vault:read",
+        challenge,
+        {
+          vault_pick: "work",
+          verb_select: "write",
+        },
+      );
+      expect(res.status).toBe(302);
+      const code = new URL(res.headers.get("location") ?? "").searchParams.get("code");
+      const scope = await redeemScope(db, code ?? "", reg.client.clientId, verifier);
+      expect(scope).toBe("vault:work:write");
+    } finally {
+      cleanup();
+    }
+  });
+
+  // Submit: owner DOWNGRADES — selects read on an unnamed vault:write → read.
+  test("owner selects read on an unnamed vault:write → minted vault:work:read (downgrade)", async () => {
+    const { db, cleanup } = await makeDb();
+    try {
+      const owner = await createUser(db, "owner", "pw");
+      const session = createSession(db, { userId: owner.id });
+      const reg = registerClient(db, {
+        redirectUris: ["https://app.example/cb"],
+        status: "approved",
+      });
+      const { verifier, challenge } = makePkce();
+      const res = await submitConsent(
+        db,
+        session.id,
+        reg.client.clientId,
+        "vault:write",
+        challenge,
+        {
+          vault_pick: "work",
+          verb_select: "read",
+        },
+      );
+      expect(res.status).toBe(302);
+      const code = new URL(res.headers.get("location") ?? "").searchParams.get("code");
+      const scope = await redeemScope(db, code ?? "", reg.client.clientId, verifier);
+      expect(scope).toBe("vault:work:read");
+    } finally {
+      cleanup();
+    }
+  });
+
+  // SECURITY: a non-owner who holds only READ on the picked vault forges
+  // verb_select=admin → the server re-derives ownership (no admin held) and
+  // refuses to widen; the cap is the backstop. Minted scope is capped to
+  // their actual authority (read), NOT elevated to admin.
+  test("SECURITY: read-only-assigned non-owner forges verb_select=admin → minted vault:work:read, NOT admin", async () => {
+    const { db, cleanup } = await makeDb();
+    try {
+      await createUser(db, "owner", "pw"); // first admin = owner
+      const reader = await createUser(db, "reader", "pw", { allowMulti: true });
+      // Assign "work" with role=read directly → holds read only (NOT admin).
+      // setUserVaults hardcodes role=write, so insert the read row by hand to
+      // construct the read-only-authority case the cap must defend.
+      db.prepare(
+        "INSERT INTO user_vaults (user_id, vault_name, role, created_at) VALUES (?, ?, 'read', ?)",
+      ).run(reader.id, "work", new Date().toISOString());
+      const session = createSession(db, { userId: reader.id });
+      const reg = registerClient(db, {
+        redirectUris: ["https://app.example/cb"],
+        status: "approved",
+      });
+      const { verifier, challenge } = makePkce();
+      const res = await submitConsent(
+        db,
+        session.id,
+        reg.client.clientId,
+        "vault:read",
+        challenge,
+        {
+          vault_pick: "work",
+          verb_select: "admin", // FORGED — reader holds read only
+        },
+      );
+      // Read survives (held); admin never rides along.
+      expect(res.status).toBe(302);
+      const code = new URL(res.headers.get("location") ?? "").searchParams.get("code");
+      expect(code).toBeTruthy();
+      const scope = await redeemScope(db, code ?? "", reg.client.clientId, verifier);
+      expect(scope).toBe("vault:work:read");
+      expect(scope).not.toContain("admin");
+      // And the recorded grant carries no admin verb either.
+      const grant = findGrant(db, reader.id, reg.client.clientId);
+      expect(grant?.scopes ?? []).not.toContain("vault:work:admin");
+    } finally {
+      cleanup();
+    }
+  });
+
+  // SECURITY: a non-admin assigned to "work" picks/forges admin on "other"
+  // (a vault outside their assignment) — the assignment-mismatch gate refuses
+  // before widening ever runs. No token minted.
+  test("SECURITY: forged verb_select=admin against an UNASSIGNED vault → 400 (mismatch gate, no mint)", async () => {
+    const { db, cleanup } = await makeDb();
+    try {
+      await createUser(db, "owner", "pw");
+      const friend = await createUser(db, "friend", "pw", { allowMulti: true });
+      setUserVaults(db, friend.id, ["work"]); // assigned "work" only
+      const session = createSession(db, { userId: friend.id });
+      const reg = registerClient(db, {
+        redirectUris: ["https://app.example/cb"],
+        status: "approved",
+      });
+      const { challenge } = makePkce();
+      const res = await submitConsent(
+        db,
+        session.id,
+        reg.client.clientId,
+        "vault:read",
+        challenge,
+        {
+          vault_pick: "other", // NOT in friend's assignment
+          verb_select: "admin",
+        },
+      );
+      expect(res.status).toBe(400);
+      expect(findGrant(db, friend.id, reg.client.clientId)).toBeNull();
+    } finally {
+      cleanup();
+    }
+  });
+
+  // Owner without a verb_select field (older form / JS-off) → unchanged
+  // behavior: the unnamed verb narrows as-requested (vault:read → work:read).
+  test("owner with NO verb_select → unchanged narrowing (vault:read → vault:work:read)", async () => {
+    const { db, cleanup } = await makeDb();
+    try {
+      const owner = await createUser(db, "owner", "pw");
+      const session = createSession(db, { userId: owner.id });
+      const reg = registerClient(db, {
+        redirectUris: ["https://app.example/cb"],
+        status: "approved",
+      });
+      const { verifier, challenge } = makePkce();
+      const res = await submitConsent(
+        db,
+        session.id,
+        reg.client.clientId,
+        "vault:read",
+        challenge,
+        {
+          vault_pick: "work",
+          // no verb_select
+        },
+      );
+      expect(res.status).toBe(302);
+      const code = new URL(res.headers.get("location") ?? "").searchParams.get("code");
+      const scope = await redeemScope(db, code ?? "", reg.client.clientId, verifier);
+      expect(scope).toBe("vault:work:read");
+    } finally {
+      cleanup();
+    }
+  });
+});

package/src/__tests__/oauth-ui.test.ts

@@ -116,7 +116,8 @@ describe("renderConsent", () => {
     expect(html).toContain("vault:admin");
     // Scope explanations from the registry
     expect(html).toContain("Read your notes");
-    expect(html).toContain("Full vault access");
+    // hub#689 Leg 1: the admin label now enumerates the concrete grants.
+    expect(html).toContain("Read and write everything, plus admin");
   });
 
   test("highlights admin scopes with a danger color and badge", () => {
@@ -252,6 +253,59 @@ describe("renderConsent", () => {
     expect(html).not.toContain("You have no assigned vaults");
     expect(html).not.toContain('value="yes" class="btn btn-primary" disabled');
   });
+
+  // hub#689 — owner-on-own-vault verb selector rendering.
+  test("renders the owner verb selector (read/write/admin), pre-selected to admin", () => {
+    const html = renderConsent({
+      params: { ...PARAMS, scope: "vault:read" },
+      csrfToken: CSRF,
+      clientId: "c",
+      clientName: "App",
+      scopes: ["vault:read"],
+      vaultPicker: { unnamedVerbs: ["read"], availableVaults: ["work"], lockedVault: "work" },
+      ownerVerbSelector: { requestedVerbs: ["read"] },
+    });
+    expect(html).toContain("Access level");
+    expect(html).toContain('name="verb_select" value="read"');
+    expect(html).toContain('name="verb_select" value="write"');
+    expect(html).toContain('name="verb_select" value="admin"');
+    // Admin is the pre-selected (checked) option.
+    expect(html).toMatch(/name="verb_select" value="admin"[^>]*checked/);
+    // read/write are NOT pre-checked.
+    expect(html).not.toMatch(/name="verb_select" value="read"[^>]*checked/);
+    expect(html).not.toMatch(/name="verb_select" value="write"[^>]*checked/);
+  });
+
+  test("owner verb selector keeps the admin option visibly flagged (admin badge + red border)", () => {
+    const html = renderConsent({
+      params: { ...PARAMS, scope: "vault:read" },
+      csrfToken: CSRF,
+      clientId: "c",
+      clientName: "App",
+      scopes: ["vault:read"],
+      vaultPicker: { unnamedVerbs: ["read"], availableVaults: ["work"], lockedVault: "work" },
+      ownerVerbSelector: { requestedVerbs: ["read"] },
+    });
+    // The .scope-admin red-border class + the admin badge ride on the admin
+    // radio option so a pre-selected admin grant stays transparent.
+    expect(html).toContain("verb-option-admin");
+    expect(html).toContain("scope-admin");
+    expect(html).toContain("badge-admin");
+  });
+
+  test("does NOT render the verb selector when ownerVerbSelector is absent (non-owner)", () => {
+    const html = renderConsent({
+      params: { ...PARAMS, scope: "vault:read" },
+      csrfToken: CSRF,
+      clientId: "c",
+      clientName: "App",
+      scopes: ["vault:read"],
+      vaultPicker: { unnamedVerbs: ["read"], availableVaults: ["work"], lockedVault: "work" },
+      // ownerVerbSelector omitted → no selector
+    });
+    expect(html).not.toContain("Access level");
+    expect(html).not.toContain('name="verb_select"');
+  });
 });
 
 describe("renderError", () => {

package/src/__tests__/scope-explanations.test.ts

@@ -29,6 +29,25 @@ describe("SCOPE_EXPLANATIONS", () => {
     }
   });
 
+  // hub#689 Leg 1: the vault:admin consent copy must enumerate what
+  // admin actually grants (config/settings, triggers/automation, GitHub
+  // backup, token minting) on top of read/write — so the consent screen
+  // is honest about the admin blast radius, not a vague "configuration
+  // changes" hand-wave.
+  test("vault:admin label enumerates the concrete admin grants (hub#689 Leg 1)", () => {
+    const label = SCOPE_EXPLANATIONS["vault:admin"]?.label ?? "";
+    const lower = label.toLowerCase();
+    expect(SCOPE_EXPLANATIONS["vault:admin"]?.level).toBe("admin");
+    // Read + write are still part of what admin grants.
+    expect(lower).toContain("read");
+    expect(lower).toContain("write");
+    // The four enumerated admin powers.
+    expect(lower).toContain("config");
+    expect(lower).toContain("trigger");
+    expect(lower).toContain("github");
+    expect(lower).toContain("token");
+  });
+
   test("FIRST_PARTY_SCOPES is sorted and matches the keys of SCOPE_EXPLANATIONS", () => {
     expect(FIRST_PARTY_SCOPES).toEqual([...FIRST_PARTY_SCOPES].sort());
     expect(new Set(FIRST_PARTY_SCOPES)).toEqual(new Set(Object.keys(SCOPE_EXPLANATIONS)));

package/src/__tests__/setup-wizard.test.ts

@@ -990,6 +990,123 @@ describe("handleSetupGet", () => {
       db.close();
     }
   });
+
+  // hub#618: gate the JSON `?op=` op-snapshot once setup is complete.
+  // Mid-setup it stays OPEN (the unauth CLI wizard + brand-new-operator
+  // browser both poll it before any session exists); post-complete it
+  // requires a session or loopback (it's a post-setup admin surface, and
+  // `/admin/setup` is always lockout-exempt so it's otherwise unauth-reachable).
+
+  test("mid-setup unauth ?op= still returns the op snapshot (hub#618 regression guard)", async () => {
+    const db = openHubDb(hubDbPath(h.dir));
+    try {
+      // No admin yet → setup INCOMPLETE → the surface stays open.
+      const reg = getDefaultOperationsRegistry();
+      const op = reg.create("install", "vault");
+      reg.update(op.id, { status: "running" }, "running bun add -g @openparachute/vault@latest");
+      const res = handleSetupGet(
+        req(`/admin/setup?op=${op.id}`, { headers: { accept: "application/json" } }),
+        {
+          db,
+          manifestPath: h.manifestPath,
+          configDir: h.dir,
+          readExposeStateFn: h.readExposeStateFn,
+          issuer: "https://hub.example",
+          registry: reg,
+          // No loopback flag, no session — the unauth first-boot poll.
+        },
+      );
+      expect(res.status).toBe(200);
+      const body = (await res.json()) as {
+        hasAdmin: boolean;
+        operation?: { id: string; status: string; log: readonly string[] };
+      };
+      expect(body.hasAdmin).toBe(false);
+      expect(body.operation).toBeDefined();
+      expect(body.operation?.id).toBe(op.id);
+      expect(body.operation?.status).toBe("running");
+    } finally {
+      db.close();
+    }
+  });
+
+  test("post-complete unauth ?op= omits the op snapshot; session OR loopback restores it (hub#618)", async () => {
+    const db = openHubDb(hubDbPath(h.dir));
+    try {
+      // Drive state to COMPLETE: admin + vault + expose mode.
+      const user = await createUser(db, "owner", "pw");
+      writeManifest(
+        {
+          services: [
+            {
+              name: "parachute-vault",
+              version: "0.1.0",
+              port: 1940,
+              paths: ["/vault/default"],
+              health: "/health",
+            },
+          ],
+        },
+        h.manifestPath,
+      );
+      setSetting(db, "setup_expose_mode", "localhost");
+      const reg = getDefaultOperationsRegistry();
+      const op = reg.create("install", "vault");
+      reg.update(op.id, { status: "running" }, "still running");
+
+      const deps = {
+        db,
+        manifestPath: h.manifestPath,
+        configDir: h.dir,
+        readExposeStateFn: h.readExposeStateFn,
+        issuer: "https://hub.example",
+        registry: reg,
+      };
+
+      // (a) Unauth, non-loopback → operation omitted.
+      const unauth = handleSetupGet(
+        req(`/admin/setup?op=${op.id}`, { headers: { accept: "application/json" } }),
+        deps,
+      );
+      expect(unauth.status).toBe(200);
+      const unauthBody = (await unauth.json()) as {
+        hasAdmin: boolean;
+        hasVault: boolean;
+        hasExposeMode: boolean;
+        operation?: unknown;
+      };
+      // Confirm setup actually derived as complete (else the gate is vacuous).
+      expect(unauthBody.hasAdmin).toBe(true);
+      expect(unauthBody.hasVault).toBe(true);
+      expect(unauthBody.hasExposeMode).toBe(true);
+      expect(unauthBody.operation).toBeUndefined();
+
+      // (b) Valid session → operation restored.
+      const { createSession } = await import("../sessions.ts");
+      const session = createSession(db, { userId: user.id });
+      const authed = handleSetupGet(
+        req(`/admin/setup?op=${op.id}`, {
+          headers: {
+            accept: "application/json",
+            cookie: `${SESSION_COOKIE_NAME}=${session.id}`,
+          },
+        }),
+        deps,
+      );
+      const authedBody = (await authed.json()) as { operation?: { id: string } };
+      expect(authedBody.operation?.id).toBe(op.id);
+
+      // (c) Loopback (no session) → operation restored.
+      const loopback = handleSetupGet(
+        req(`/admin/setup?op=${op.id}`, { headers: { accept: "application/json" } }),
+        { ...deps, requestIsLoopback: true },
+      );
+      const loopbackBody = (await loopback.json()) as { operation?: { id: string } };
+      expect(loopbackBody.operation?.id).toBe(op.id);
+    } finally {
+      db.close();
+    }
+  });
 });
 
 // --- POST /admin/setup/account -------------------------------------------

package/src/clients.ts

@@ -323,9 +323,23 @@ function timingSafeEqualHex(a: string, b: string): boolean {
  * URIs). Doesn't try to match a registered URI; that's `requireRegisteredRedirectUri`.
  */
 export function isValidRedirectUri(uri: string): boolean {
+  // hub#663: reject control chars (C0 0x00-0x1f + DEL 0x7f) in the RAW input
+  // BEFORE URL parsing normalizes/strips them. A `\r`/`\n`/NUL smuggled into a
+  // redirect_uri is a header/log-injection vector even though our exact-match +
+  // verbatim foreign-storage neutralize it downstream — spec-forbidden hygiene.
+  // (Charcode scan rather than a control-char regex literal, which biome's
+  // noControlCharactersInRegex rightly flags as an easy footgun.)
+  for (let i = 0; i < uri.length; i++) {
+    const c = uri.charCodeAt(i);
+    if (c <= 0x1f || c === 0x7f) return false;
+  }
   try {
     const u = new URL(uri);
     if (u.protocol === "javascript:" || u.protocol === "data:") return false;
+    // hub#663: reject userinfo (`https://x@evil.com/cb`). A redirect target
+    // carrying credentials is spec-forbidden and an open-redirect / phishing
+    // shape; the protocol allowlist alone let it through.
+    if (u.username !== "" || u.password !== "") return false;
     return u.protocol === "http:" || u.protocol === "https:";
   } catch {
     return false;

package/src/hub-server.ts

@@ -3824,13 +3824,57 @@ async function decorateWithChrome(
   if (setCookie && out !== res) {
     const headers = new Headers(out.headers);
     headers.append("set-cookie", setCookie);
-    return new Response(out.body, {
-      status: out.status,
-      statusText: out.statusText,
-      headers,
-    });
+    return withProxySecurityHeaders(
+      new Response(out.body, {
+        status: out.status,
+        statusText: out.statusText,
+        headers,
+      }),
+    );
   }
-  return out;
+  // hub#643: every exit runs through the security-header step, which self-
+  // gates on content-type — so a non-HTML pass-through (`out === res`, e.g. a
+  // 502 proxy error or a JSON/asset body) is returned unchanged, preserving
+  // the pre-existing behavior for those responses.
+  return withProxySecurityHeaders(out);
+}
+
+/**
+ * hub#643 (Tier-1): stamp non-script security headers on proxied `text/html`
+ * pages — the per-vault `/vault/<name>/*` proxy and the generic
+ * services-mount `/<mount>/*` proxy both flow through `decorateWithChrome`,
+ * so this is the single chokepoint that covers a module / surface page.
+ *
+ *   - `X-Content-Type-Options: nosniff` — stops content-type sniffing.
+ *   - `Content-Security-Policy: frame-ancestors 'self'; object-src 'none';
+ *     base-uri 'self'` — clickjacking (external framing) + plugin + base-tag
+ *     hardening.
+ *
+ * Deliberately NO `script-src`: a strict script-src would white-screen
+ * self-built GitHub-hosted surfaces (the primary surface story) and
+ * inline-script module pages. The opt-in strict script-src CSP is Tier-2,
+ * explicitly deferred (hub#643 stays open).
+ *
+ * Header-only: we never buffer the body. Only `text/html` responses are
+ * decorated, so JSON / `.js` / CSS / image assets proxied through the same
+ * path are left untouched. Existing headers are preserved (a fresh Headers
+ * copy is mutated); we set (not append) so a re-decorated response can't
+ * accumulate duplicates.
+ */
+function withProxySecurityHeaders(res: Response): Response {
+  const contentType = res.headers.get("content-type") ?? "";
+  if (!contentType.toLowerCase().includes("text/html")) return res;
+  const headers = new Headers(res.headers);
+  headers.set("x-content-type-options", "nosniff");
+  headers.set(
+    "content-security-policy",
+    "frame-ancestors 'self'; object-src 'none'; base-uri 'self'",
+  );
+  return new Response(res.body, {
+    status: res.status,
+    statusText: res.statusText,
+    headers,
+  });
 }
 
 if (import.meta.main) {

package/src/oauth-handlers.ts

@@ -1209,9 +1209,31 @@ export function handleAuthorizeGet(db: Database, req: Request, deps: OAuthDeps):
     return issueAuthCodeRedirect(db, parsed, requestedScopes, session.userId, deps);
   }
 
+  // hub#689 — does the user hold ADMIN on every vault they could pick? Admin
+  // (isFirstAdmin) owns the whole hub. A non-admin owns a vault only if their
+  // `user_vaults` role grants admin there (today role=write does; a role=read
+  // assignment would NOT). Re-derived from the DB so the owner-verb-selector
+  // is offered only to a genuine owner — the submit path re-checks the PICKED
+  // vault and the cap is the backstop, but rendering it precisely avoids
+  // promising an admin upgrade the cap would silently demote.
+  const userHoldsAdminOnPickable =
+    userIsAdmin ||
+    (assignedVaults.length > 0 &&
+      assignedVaults.every((v) =>
+        (vaultVerbsForUserVault(db, session.userId, v) ?? []).includes("admin"),
+      ));
+
   return htmlResponse(
     renderConsent(
-      consentProps(client, parsed, vaultNames, csrf.token, assignedVaults, userIsAdmin),
+      consentProps(
+        client,
+        parsed,
+        vaultNames,
+        csrf.token,
+        assignedVaults,
+        userIsAdmin,
+        userHoldsAdminOnPickable,
+      ),
     ),
     200,
     extra,
@@ -1270,7 +1292,8 @@ function capScopesToUserAuthority(
     if (name === undefined || verb === undefined || !VAULT_VERBS.has(verb)) return true;
     // Named vault verb requested by a non-owner: admit only if the user holds
     // it. `vaultVerbsForUserVault` returns null for an unassigned vault (drop)
-    // or the held verb list (today read/write only — never admin).
+    // or the held verb list — a `write` role holds [read, write, admin], a
+    // `read` role holds [read] (see `vaultVerbsForRole`).
     const held = vaultVerbsForUserVault(db, userId, name);
     return held !== null && (held as readonly string[]).includes(verb);
   });
@@ -1682,6 +1705,44 @@ async function handleConsentSubmit(
         400,
       );
     }
+    // hub#689 — owner-on-own-vault verb widening. The consent screen offers
+    // owners a read/write/admin selector (pre-selected to admin) for an
+    // unnamed `vault:read`/`vault:write` request, so an owner whose AI client
+    // asked for read-only can grant the level it actually needs in-flow. The
+    // submitted `verb_select` is an UNTRUSTED hint — we re-derive ownership of
+    // the PICKED vault server-side here, and `capScopesToUserAuthority` (inside
+    // issueAuthCodeRedirect) is the backstop that drops any verb the user
+    // doesn't actually hold. This only ever rewrites the unnamed read/write
+    // verb(s) to the selected level on the picked vault; named scopes and every
+    // other scope are untouched. A forged `verb_select=admin` from a user who
+    // doesn't own the picked vault gets capped back to what they hold (or, for
+    // a vault outside a pinned user's assignment, never reaches here — the
+    // mismatch checks above already 400'd it).
+    const selectedVerb = String(form.get("verb_select") ?? "").trim();
+    if (selectedVerb === "read" || selectedVerb === "write" || selectedVerb === "admin") {
+      // Re-derive, server-side, whether THIS user owns (holds admin on) the
+      // PICKED vault. Owner === first admin (holds admin everywhere) OR an
+      // assigned user whose role grants admin on this vault. Never trust the
+      // client-submitted selector to establish authority.
+      const heldOnPicked = vaultVerbsForUserVault(db, session.userId, pickedVault);
+      const ownsPicked = userIsAdmin || (heldOnPicked?.includes("admin") ?? false);
+      if (ownsPicked) {
+        scopes = scopes.map((s) => {
+          const parts = s.split(":");
+          // Only widen the unnamed read/write verbs the selector was offered
+          // for — leave an unnamed `vault:admin`, named scopes, and non-vault
+          // scopes exactly as requested.
+          if (
+            parts.length === 2 &&
+            parts[0] === "vault" &&
+            (parts[1] === "read" || parts[1] === "write")
+          ) {
+            return `vault:${selectedVerb}`;
+          }
+          return s;
+        });
+      }
+    }
     scopes = narrowVaultScopes(scopes, pickedVault);
   }
 
@@ -2746,6 +2807,10 @@ function consentProps(
   csrfToken: string,
   assignedVaults: readonly string[],
   userIsAdmin: boolean,
+  // hub#689 — true when the user holds admin on every vault they could pick
+  // (admin owns the hub; an assigned non-admin only if their role grants admin
+  // on each assigned vault). Gates whether the owner-verb-selector renders.
+  userHoldsAdminOnPickable = userIsAdmin,
 ) {
   const scopes = params.scope.split(" ").filter((s) => s.length > 0);
   const unnamedVerbs = unnamedVaultVerbs(scopes);
@@ -2875,6 +2940,25 @@ function consentProps(
     const only = vaultNames[0];
     if (only) displayVault = only;
   }
+  // hub#689 — owner-on-own-vault verb selector. The client requested an
+  // unnamed `vault:read`/`vault:write` verb, and the consenting user owns
+  // (holds admin on) every vault they could pick — first admin owns the whole
+  // hub; an assigned non-admin holds admin on each of their assigned vaults
+  // (vaultVerbsForRole('write') → [read,write,admin]). Offer the selector so
+  // they can grant the level their client actually needs (or downgrade), with
+  // admin pre-selected. Suppressed when the request can't be authorized (zero-
+  // vault non-admin) or the assignment is stale (no valid vault to own).
+  //
+  // SECURITY: this only DECIDES WHETHER TO RENDER. The actual widening is
+  // re-derived server-side in `handleConsentSubmit` against the *picked* vault
+  // and capped by `capScopesToUserAuthority`. The selector value is a hint.
+  const upgradeableUnnamedVerbs = unnamedVerbs.filter((v) => v === "read" || v === "write");
+  const userOwnsEveryPickableVault =
+    !hasStaleAssignment && userCanAuthorizeRequest && userHoldsAdminOnPickable;
+  const ownerVerbSelector =
+    upgradeableUnnamedVerbs.length > 0 && userOwnsEveryPickableVault
+      ? { requestedVerbs: upgradeableUnnamedVerbs }
+      : undefined;
   return {
     params,
     clientId: client.clientId,
@@ -2883,6 +2967,7 @@ function consentProps(
     csrfToken,
     vaultPicker,
     displayVault,
+    ownerVerbSelector,
     staleAssignedVault,
     // Approve stays enabled for non-vault scopes even when assigned_vault
     // is stale — the user can still consent to e.g. `scribe:transcribe`

package/src/oauth-ui.ts

@@ -147,6 +147,31 @@ export interface ConsentViewProps {
    * the user on an error page. Defaults to authorizable when omitted.
    */
   userCanAuthorizeRequest?: boolean;
+  /**
+   * hub#689 — owner-on-own-vault verb selector. Set when the consenting user
+   * OWNS (holds admin on) every vault they could pick AND the client requested
+   * an unnamed `vault:read`/`vault:write` verb. Renders a read/write/admin
+   * radio group, pre-selected to admin, so the owner can grant the level their
+   * AI client actually needs in-flow (the requested-scope shape was the
+   * blocker, not the user's authority) — or transparently downgrade.
+   *
+   * The submitted `verb_select` is an UNTRUSTED hint: the consent-submit
+   * handler re-derives, server-side, whether the user actually owns the picked
+   * vault before widening, and `capScopesToUserAuthority` remains the backstop
+   * that drops any verb the user doesn't hold. The selector only ever WIDENS
+   * the unnamed verb(s) on the picked vault; it never touches any other scope.
+   */
+  ownerVerbSelector?: OwnerVerbSelector;
+}
+
+export interface OwnerVerbSelector {
+  /**
+   * The unnamed read/write verb(s) the client requested. Only `read`/`write`
+   * are upgradeable here — an unnamed `vault:admin` request already renders
+   * with the admin badge and needs no selector. Used to word the selector
+   * help text ("the app asked for write access").
+   */
+  requestedVerbs: string[];
 }
 
 export interface VaultPicker {
@@ -328,6 +353,7 @@ export function renderConsent(props: ConsentViewProps): string {
     staleAssignedVault,
     blockApproveForStaleAssignment,
     userCanAuthorizeRequest,
+    ownerVerbSelector,
   } = props;
   // Substitute unnamed `vault:<verb>` rows with the resolved named form so
   // the operator sees the scope shape that will appear in the token. Raw
@@ -339,6 +365,7 @@ export function renderConsent(props: ConsentViewProps): string {
       ? `<li class="scope scope-empty">No scopes requested — the app gets a session token only.</li>`
       : displayedScopes.map(renderScopeRow).join("\n");
   const pickerSection = vaultPicker ? renderVaultPicker(vaultPicker) : "";
+  const verbSelectorSection = ownerVerbSelector ? renderOwnerVerbSelector(ownerVerbSelector) : "";
   // Approve is disabled when the picker can't yield a valid vault. The
   // empty-vault branch (no vaults registered) is the original case. A
   // locked-vault picker (multi-user Phase 1) always has a valid value via
@@ -418,6 +445,7 @@ export function renderConsent(props: ConsentViewProps): string {
         ${renderCsrfHiddenInput(csrfToken)}
         ${renderHiddenInputs(params)}
         ${pickerSection}
+        ${verbSelectorSection}
         <div class="button-row">
           <button type="submit" name="approve" value="yes" class="btn btn-primary"${approveDisabled}>Approve</button>
           <button type="submit" name="approve" value="no" class="btn btn-secondary">Deny</button>
@@ -492,6 +520,60 @@ function renderVaultPicker(picker: VaultPicker): string {
         </section>`;
 }
 
+/**
+ * hub#689 — owner-on-own-vault verb selector. Rendered only when the
+ * consenting user owns (holds admin on) every vault they could pick and the
+ * client requested an unnamed `vault:read`/`vault:write` verb. Three radios
+ * (read / write / admin), pre-selected to **admin** so the common case (the
+ * owner's own AI client that needs full access) is one click — but the owner
+ * sees and submits the choice, and can downgrade.
+ *
+ * The `admin` option keeps the `.scope-admin` red border + admin badge so an
+ * admin grant stays visibly flagged even when pre-selected. The submitted
+ * `verb_select` is an untrusted hint re-checked server-side (ownership
+ * re-derivation in `handleConsentSubmit` + `capScopesToUserAuthority` backstop);
+ * this template only renders the choice.
+ */
+function renderOwnerVerbSelector(selector: OwnerVerbSelector): string {
+  const requested = selector.requestedVerbs.map((v) => `<code>vault:${escapeHtml(v)}</code>`);
+  const requestedList =
+    requested.length === 1
+      ? requested[0]
+      : `${requested.slice(0, -1).join(", ")} and ${requested.at(-1)}`;
+  const option = (
+    verb: "read" | "write" | "admin",
+    title: string,
+    desc: string,
+    checked: boolean,
+  ): string => {
+    const isAdmin = verb === "admin";
+    const cls = `verb-option${isAdmin ? " verb-option-admin scope-admin" : ""}`;
+    const badge = isAdmin ? `<span class="badge badge-admin">admin</span>` : "";
+    return `
+            <label class="${cls}">
+              <input type="radio" name="verb_select" value="${verb}"${checked ? " checked" : ""} />
+              <span class="verb-option-body">
+                <span class="verb-option-head">
+                  <span class="verb-option-title">${escapeHtml(title)}</span>
+                  ${badge}
+                </span>
+                <span class="verb-option-desc">${escapeHtml(desc)}</span>
+              </span>
+            </label>`;
+  };
+  return `
+        <section class="verb-selector">
+          <h2 class="scopes-title">Access level</h2>
+          <p class="picker-help">
+            This app asked for ${requestedList} access to your vault. Because you own
+            this vault, you can grant a different level — admin is selected so your app
+            can do everything it might need; lower it if you'd rather not.
+          </p>
+          <div class="verb-options">${option("read", "Read only", "View notes, tags, attachments, and config.", false)}${option("write", "Read & write", "Create, edit, and delete notes, tags, and attachments.", false)}${option("admin", "Admin", "Full access plus config, triggers/automation, GitHub backup, and minting tokens.", true)}
+          </div>
+        </section>`;
+}
+
 /**
  * "App not yet approved" page (#74). Two branches:
  *
@@ -1282,6 +1364,47 @@ const STYLES = `
     font-size: 0.88rem;
     color: ${PALETTE.fg};
   }
+  /* hub#689 — owner-on-own-vault verb selector. Same card shell as the
+     vault picker; the admin option carries the .scope-admin red border so an
+     admin grant stays visibly flagged even when pre-selected. */
+  .verb-selector {
+    margin: 0 0 1.25rem;
+    padding: 0.75rem 0.85rem;
+    border: 1px solid ${PALETTE.borderLight};
+    border-radius: 6px;
+    background: ${PALETTE.bgSoft};
+  }
+  .verb-selector .scopes-title { margin-bottom: 0.4rem; }
+  .verb-options {
+    display: flex;
+    flex-direction: column;
+    gap: 0.4rem;
+  }
+  .verb-option {
+    display: flex;
+    align-items: flex-start;
+    gap: 0.5rem;
+    padding: 0.5rem 0.65rem;
+    border: 1px solid ${PALETTE.border};
+    border-radius: 6px;
+    background: ${PALETTE.cardBg};
+    cursor: pointer;
+    transition: border-color 0.15s ease, background 0.15s ease;
+  }
+  .verb-option:hover { border-color: ${PALETTE.accent}; }
+  .verb-option input[type=radio] { margin-top: 0.25rem; }
+  .verb-option input[type=radio]:focus { outline: 2px solid ${PALETTE.accent}; outline-offset: 2px; }
+  .verb-option-body { display: flex; flex-direction: column; gap: 0.1rem; }
+  .verb-option-head {
+    display: flex;
+    align-items: center;
+    gap: 0.4rem;
+    flex-wrap: wrap;
+  }
+  .verb-option-title { font-weight: 500; color: ${PALETTE.fg}; font-size: 0.9rem; }
+  .verb-option-desc { font-size: 0.82rem; color: ${PALETTE.fgMuted}; }
+  .verb-option-admin .verb-option-title { color: ${PALETTE.danger}; }
+
   .vault-picker-empty .picker-help { color: ${PALETTE.danger}; }
   .vault-picker-empty .picker-help code { color: ${PALETTE.fg}; }
   .vault-picker-locked .picker-help { color: ${PALETTE.fgMuted}; }

package/src/scope-explanations.ts

@@ -42,7 +42,8 @@ export const SCOPE_EXPLANATIONS: Record<string, ScopeExplanation> = {
     level: "write",
   },
   "vault:admin": {
-    label: "Full vault access plus configuration changes (rotate tokens, change settings).",
+    label:
+      "Read and write everything, plus admin: config & settings, triggers & automation, GitHub backup, and minting access tokens.",
     level: "admin",
   },
   // Optional-module scopes (scribe / agent). These are in FIRST_PARTY_SCOPES

package/src/setup-wizard.ts

@@ -1592,14 +1592,33 @@ export function handleSetupGet(req: Request, deps: SetupWizardDeps): Response {
     // poll on the auth the wizard already carries.
     const opId = url.searchParams.get("op");
     if (opId) {
-      const op = deps.registry?.get(opId);
-      if (op) {
-        envelope.operation = {
-          id: op.id,
-          status: op.status,
-          log: op.log,
-          ...(op.error !== undefined ? { error: op.error } : {}),
-        };
+      // hub#618: post-setup this JSON `?op=` surface is unauth-reachable —
+      // `/admin/setup` is always lockout-exempt (the dispatcher's
+      // `shouldGateForSetup` lets it through so a stale bookmark resolves), and
+      // the snapshot is read BEFORE any session check. The leak is small (an
+      // in-memory op's status + install-progress log lines, behind an
+      // unguessable UUID), but it's still a post-setup admin surface, so gate
+      // it once setup is COMPLETE. During setup (no admin yet) the surface
+      // stays OPEN: the unauth CLI wizard (`parachute init`) AND the brand-new-
+      // operator browser both poll this `?op=` snapshot mid-setup before any
+      // session exists — gating then would break first-boot vault
+      // provisioning. Loopback always passes (same on-box trust as the
+      // `bootstrapToken` branch below); a valid session also passes.
+      const setupComplete = state.hasAdmin && state.hasVault && state.hasExposeMode;
+      const opSnapshotAllowed =
+        !setupComplete ||
+        deps.requestIsLoopback === true ||
+        findActiveSession(deps.db, req) !== null;
+      if (opSnapshotAllowed) {
+        const op = deps.registry?.get(opId);
+        if (op) {
+          envelope.operation = {
+            id: op.id,
+            status: op.status,
+            log: op.log,
+            ...(op.error !== undefined ? { error: op.error } : {}),
+          };
+        }
       }
     }
     // hub#576: hand the actual token to a LOOPBACK caller only. The on-box