@openparachute/hub 0.7.6 → 0.7.7-rc.12

package/src/commands/install.ts

@@ -1,3 +1,4 @@
+import type { Database } from "bun:sqlite";
 import { existsSync, readFileSync, realpathSync } from "node:fs";
 import { createConnection } from "node:net";
 import { dirname, join } from "node:path";
@@ -15,6 +16,8 @@ import {
   defaultSleep,
   readHubPort,
 } from "../hub-control.ts";
+import { hubDbPath, openHubDb } from "../hub-db.ts";
+import { resolveRootRedirectDetailed, setRootRedirect } from "../hub-settings.ts";
 import { type HubUnitDeps, defaultHubUnitDeps, isHubUnitInstalled } from "../hub-unit.ts";
 import {
   type ModuleManifest,
@@ -33,6 +36,7 @@ import {
   type FirstPartyFallback,
   KNOWN_MODULES,
   type KnownModule,
+  RETIRED_MODULES,
   type ServiceSpec,
   composeServiceSpec,
   isCanonicalPort,
@@ -126,15 +130,9 @@ export function resolveInstallChannel(opts: {
  * launch sinks in and `parachute install lens` has stopped appearing
  * in support threads.
  *
- * `channel → agent` (2026-06-17): parachute-channel was renamed to
- * parachute-agent. `parachute install channel` keeps resolving to the
- * agent module for one release cycle so operators mid-upgrade aren't
- * stranded. Remove alongside the `parachute-channel → agent` legacy
- * manifest alias in service-spec.ts.
  */
 const SERVICE_ALIASES: Record<string, string> = {
   lens: "notes",
-  channel: "agent",
 };
 
 /**
@@ -145,14 +143,41 @@ const SERVICE_ALIASES: Record<string, string> = {
  * real, non-Parachute package on npm). Install refuses with the message
  * instead.
  */
+const AGENT_RETIRED_MESSAGE =
+  "parachute-agent was retired from the hub on 2026-07-15. " +
+  "Parachute product development is focused on Vault and Surface.";
+
 const RETIRED_INSTALL_SHORTS: Record<string, string> = {
+  agent: AGENT_RETIRED_MESSAGE,
+  channel:
+    "parachute-channel (later parachute-agent) was retired from the hub on 2026-07-15. " +
+    "Parachute product development is focused on Vault and Surface.",
   runner:
     "parachute-runner was retired from the hub's module registry on 2026-07-01 " +
-    "(the module set of record is vault, hub, agent, scribe, surface). " +
+    "(the module set of record is vault, hub, scribe, surface, app). " +
     "An existing install keeps running under `parachute serve`; to install it anyway, " +
     "pass the explicit npm package name (@openparachute/runner) or a local checkout path.",
 };
 
+const RETIRED_AGENT_PACKAGES = [
+  "@openparachute/agent",
+  "@openparachute/parachute-agent",
+  "@openparachute/channel",
+  "@openparachute/parachute-channel",
+] as const;
+
+function isRetiredAgentPackage(packageName: string): boolean {
+  return RETIRED_AGENT_PACKAGES.some(
+    (retired) => packageName === retired || packageName.startsWith(`${retired}@`),
+  );
+}
+
+function isRetiredAgentManifest(manifest: ModuleManifest): boolean {
+  if (RETIRED_MODULES[manifest.name] !== undefined) return true;
+  if (manifest.manifestName && RETIRED_MODULES[manifest.manifestName] !== undefined) return true;
+  return manifest.name === "claw" && manifest.paths[0] === "/claw";
+}
+
 export interface InstallOpts {
   runner?: Runner;
   manifestPath?: string;
@@ -408,6 +433,16 @@ export interface InstallOpts {
    * origin for stable assertions.
    */
   wellKnownOrigin?: string;
+  /**
+   * Test seam for the `app`-only set-if-unset root-redirect write (hub-parity
+   * P5). Production opens `openHubDb(hubDbPath(configDir))` fresh and closes
+   * it after the write; passing this injects an already-open DB (e.g. a
+   * tempdir `hub.db`) so a test never touches the real `~/.parachute/hub.db`.
+   * Passing this ALSO opts a tempdir-manifestPath test INTO the write path —
+   * mirrors `guidanceCtx`'s discriminant: without it, the production gate
+   * (`manifestPath === SERVICES_MANIFEST_PATH`) skips the write entirely.
+   */
+  rootRedirectDb?: Database;
 }
 
 async function defaultRunner(cmd: readonly string[]): Promise<number> {
@@ -734,12 +769,20 @@ function resolveInstallTarget(
       log(`✗ ${input} has no readable package.json — can't install as a Parachute module.`);
       return null;
     }
+    if (isRetiredAgentPackage(packageName)) {
+      log(`✗ ${AGENT_RETIRED_MESSAGE}`);
+      return null;
+    }
     return { kind: "local-path", absPath: input, packageName };
   }
 
   // Anything else is treated as an npm package (bare or @scope/name). The
   // module.json contract gates this — third-party packages without a
   // manifest fail post-install with a clear error, not silently.
+  if (isRetiredAgentPackage(input)) {
+    log(`✗ ${AGENT_RETIRED_MESSAGE}`);
+    return null;
+  }
   return { kind: "npm", packageName: input };
 }
 
@@ -962,6 +1005,10 @@ export async function install(input: string, opts: InstallOpts = {}): Promise<nu
     log,
   });
   if (installedManifest === "error") return 1;
+  if (installedManifest && isRetiredAgentManifest(installedManifest)) {
+    log(`✗ ${target.packageName}: ${AGENT_RETIRED_MESSAGE}`);
+    return 1;
+  }
 
   let manifest: ModuleManifest;
   let extras: FirstPartyExtras | undefined;
@@ -969,7 +1016,7 @@ export async function install(input: string, opts: InstallOpts = {}): Promise<nu
     manifest = installedManifest ?? target.fallback.manifest;
     extras = target.fallback.extras;
   } else if (target.kind === "known-module") {
-    // KNOWN_MODULES shorts (vault / scribe / agent / surface) carry no vendored
+    // KNOWN_MODULES shorts (vault / scribe / surface) carry no vendored
     // manifest (hub#310). The module's own `.parachute/module.json` is the
     // canonical source. When it's unreadable (legacy installs from before
     // module.json shipped, or test fixtures that mock the disk path without
@@ -1351,6 +1398,37 @@ export async function install(input: string, opts: InstallOpts = {}): Promise<nu
     }
   }
 
+  // App-only: default the hub's bare `/` redirect to the app's front door on
+  // first install (hub-parity P5, 2026-07-11) — SET-IF-UNSET ONLY, never
+  // clobbering an operator's existing choice (`parachute hub
+  // set-root-redirect` or the admin SPA PUT both still win on any later run,
+  // and either can change it back). "Unset" means the resolved redirect is
+  // still the built-in `/admin` DEFAULT — i.e. NEITHER the DB row NOR the
+  // `PARACHUTE_HUB_ROOT_REDIRECT` env var (container deploys pin their landing
+  // page there) has set it. Gating on `getRootRedirect(db) === null` would
+  // miss the env tier and silently override an env-configured operator, since
+  // the DB row we'd write wins over env on read (`resolveRootRedirectDetailed`
+  // is DB-first). Gated on the same production-vs-test discriminant the
+  // guidance probe below uses: a test driving install against a tempdir
+  // manifestPath never opens the real `~/.parachute/hub.db` unless it opts in
+  // via `opts.rootRedirectDb`.
+  if (short === "app") {
+    const dbProbeAllowed =
+      opts.rootRedirectDb !== undefined || manifestPath === SERVICES_MANIFEST_PATH;
+    if (dbProbeAllowed) {
+      const db = opts.rootRedirectDb ?? openHubDb(hubDbPath(configDir));
+      try {
+        if (resolveRootRedirectDetailed(db).source === "default") {
+          setRootRedirect(db, "/app/");
+          log("✓ The hub's front page (`/`) now opens the app at /app/.");
+          log("  Change it any time: `parachute hub set-root-redirect <path>` or the admin SPA.");
+        }
+      } finally {
+        if (!opts.rootRedirectDb) db.close();
+      }
+    }
+  }
+
   // Per-service install footer — canonical next-step URLs and configuration
   // hints. Vault prints its own (richer) footer from `parachute-vault init`
   // (PR #166), so the spec leaves vault out and we don't double up here.

package/src/commands/migrate.ts

@@ -106,7 +106,11 @@ export function safelistEntries(): Set<string> {
  * list once enough operator cycles have passed to be confident no
  * install is still on the Lens-era code path.
  */
-export const KNOWN_ARCHIVABLE_DIRS: ReadonlySet<string> = new Set<string>(["lens"]);
+export const KNOWN_ARCHIVABLE_DIRS: ReadonlySet<string> = new Set<string>([
+  "lens",
+  "agent",
+  "channel",
+]);
 
 /**
  * Known-cruft rules. Each rule names a label (the friendly description in

package/src/commands/setup.ts

@@ -110,7 +110,7 @@ function defaultAvailability(): InteractiveAvailability {
 
 /**
  * Survey ALL known first-party shortnames (vault / notes / scribe / agent /
- * surface) regardless of tier — `installed` is true when the service
+ * surface / app) regardless of tier — `installed` is true when the service
  * has a row in services.json. The fresh-install OFFER is narrowed downstream
  * by `isOfferable` (drops already-installed + `deprecated`-tier shorts —
  * notes); agent (`experimental`) is flagged exploratory in its blurb
@@ -121,7 +121,7 @@ function defaultAvailability(): InteractiveAvailability {
  * like any unknown row it neither blocks setup nor appears in the offer.
  *
  * The full ServiceSpec is only available pre-install for FIRST_PARTY_FALLBACKS
- * shorts (notes — it carries a vendored manifest). KNOWN_MODULES shorts
+ * shorts (notes / app — both carry a vendored manifest). KNOWN_MODULES shorts
  * (vault / scribe / agent / surface) ship `.parachute/module.json`
  * and self-register; pre-install we know manifestName + the urlForEntry quirk
  * from `KNOWN_MODULES[short].extras`, which is all the survey/summary needs.
@@ -175,14 +175,17 @@ export function isOfferable(choice: { short: string; installed: boolean }): bool
 const BLURBS: Record<string, string> = {
   vault: "knowledge graph (MCP) — your owner-authenticated note + tag store",
   surface: "Parachute UI host — auto-installs Notes on first boot (the recommended UI path)",
-  // `app` is the pre-2026-05-27 name for `surface`; kept for any legacy survey row.
-  app: "Parachute UI host — auto-installs Notes on first boot (recommended over notes-daemon)",
+  // hub-parity P5 (2026-07-11): `app` is now the NEW super-surface front
+  // door (@openparachute/parachute-app) — a real FIRST_PARTY_FALLBACKS
+  // entry, not a legacy survey row. It is UNRELATED to the pre-2026-05-27
+  // `app` package that renamed to `surface` (that blurb lives under the
+  // `surface` key above); the two just happen to share the short name
+  // across a rename.
+  app: "the super-surface front door — one app to sign in, browse your vault, and manage your hub/cloud",
   // notes is `deprecated` (not offered on a fresh setup) — this blurb only
   // renders if a legacy install surfaces it in the survey.
   notes: "Notes PWA — web/mobile UI on top of vault (notes-daemon; superseded by `surface`)",
   scribe: "audio transcription for dictation + recordings",
-  agent:
-    "(exploratory) chat with your Claude Code sessions — a channel per session (renamed from channel)",
 };
 
 function blurbFor(choice: ServiceChoice): string {

package/src/help.ts

@@ -362,11 +362,11 @@ Exit codes:
 
 Example:
   $ parachute status
-  SERVICE          PORT  VERSION  STATE   PID    UPTIME  LATENCY  SOURCE
-  parachute-vault  1940  0.2.4    active  12345  2h 13m  2ms      bun-linked → parachute-vault @ 8aa167b
+  SERVICE            PORT  VERSION  STATE   PID    UPTIME  LATENCY  SOURCE
+  parachute-vault    1940  0.2.4    active  12345  2h 13m  2ms      bun-linked → parachute-vault @ 8aa167b
     → http://127.0.0.1:1940/vault/default/mcp
-  parachute-app    1946  0.2.0    active  12346  2h 12m  3ms      npm (0.2.0-rc.4)
-    → http://127.0.0.1:1946/surface/notes
+  parachute-surface  1946  0.2.0    active  12346  2h 12m  3ms      npm (0.2.0-rc.4)
+    → http://127.0.0.1:1946/surface
 `;
 }
 
@@ -551,8 +551,8 @@ Examples:
 Module start commands (run by the supervisor under \`serve\`):
   vault     parachute-vault serve
   scribe    parachute-scribe serve
-  app       parachute-app serve
-  agent     parachute-agent
+  surface   parachute-surface serve
+  app       bun <cli>/notes-serve.ts --port <configured> --mount <paths[0]> --package @openparachute/parachute-app
   notes     bun <cli>/notes-serve.ts --port <configured> --mount <paths[0]>   # back-compat: legacy notes-daemon
 `;
 }