@openparachute/hub 0.7.7-rc.8 → 0.7.7

package/src/setup-wizard.ts

@@ -41,6 +41,7 @@ import type { Database } from "bun:sqlite";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { recordLoginUnlock } from "./admin-lock.ts";
+import { provisionVault } from "./admin-vaults.ts";
 import { type OperationsRegistry, runInstall, specFor } from "./api-modules-ops.ts";
 import { CURATED_MODULES, type CuratedModuleShort } from "./api-modules.ts";
 import {
@@ -307,15 +308,34 @@ export function deriveWizardState(deps: {
   // phantom `vaults[]` row at SEED_VERSION); both surfaces must agree that a
   // placeholder is not a real vault.
   const vaultIsPlaceholder = vaultEntry !== undefined && vaultEntry.version === SEED_VERSION;
+  // hub#607-followup (the e2e wizard-skip bug): the SEED_VERSION check alone is
+  // NOT sufficient to distinguish "real vault" from "module installed, no
+  // instance". When the hub boot-spawns the vault module child, vault's
+  // `selfRegister` writes its services.json row at the REAL package version
+  // (e.g. 0.7.4-rc.1) but with `paths: []` (no vault instance created yet) —
+  // defeating the SEED_VERSION sentinel. A bare `version !== SEED_VERSION`
+  // check then read that empty-paths row as a real vault, so the wizard
+  // SILENTLY SKIPPED its vault step and `--vault-mode create --vault-name` was
+  // ignored (the operator finished setup with no vault). Make the check
+  // INSTANCE-aware: a real vault also requires at least one mount path. This is
+  // the SAME empty-paths discrimination `findExistingVault` /
+  // `listVaultInstanceNames` already use (#478) — a servable instance carries a
+  // canonical `/vault/<name>` path; a self-registered-but-uncreated row has
+  // `paths: []` and must read as "no real vault yet." A SEED_VERSION seed row
+  // carries `/vault/default`, so it's caught by `vaultIsPlaceholder` above and
+  // unaffected by this clause.
+  const vaultHasInstancePath = vaultEntry !== undefined && vaultEntry.paths.length > 0;
   // INVARIANT (B5 re-enterable vault step): hasRealVault means "a real
-  // instance row exists" — placeholder excluded here, skip-marker excluded
-  // below (skip flips hasVault, never hasRealVault). THREE sites key on this
-  // same placeholder logic and must move together: this derivation,
-  // handleSetupGet's `?step=vault` re-entry gate, and handleSetupVaultPost's
-  // already-provisioned short-circuit. Changing one without the others
-  // either re-opens a provisioning form over a real vault or dead-ends the
-  // post-skip re-entry path.
-  const hasRealVault = vaultEntry !== undefined && !vaultIsPlaceholder;
+  // instance row exists" — placeholder excluded here, empty-paths excluded via
+  // vaultHasInstancePath, skip-marker excluded below (skip flips hasVault,
+  // never hasRealVault). THREE sites key on this same `hasRealVault` value and
+  // must move together: this derivation, handleSetupGet's `?step=vault`
+  // re-entry gate, and handleSetupVaultPost's already-provisioned short-circuit
+  // — all three read `deriveWizardState(...).hasRealVault`, so tightening it
+  // here moves all three at once. Changing the meaning here without checking
+  // those consumers either re-opens a provisioning form over a real vault or
+  // dead-ends the post-skip re-entry path.
+  const hasRealVault = vaultEntry !== undefined && !vaultIsPlaceholder && vaultHasInstancePath;
   // hub#168 Cut 2: `setup_vault_skipped === "true"` advances the wizard
   // past the vault step even when no vault row exists. The operator
   // explicitly chose Skip; the module is installed (Cut 1) but no
@@ -416,6 +436,14 @@ export interface SetupWizardDeps {
   registry?: OperationsRegistry;
   /** Test seam: stub `bun add` / `bun remove` runner. */
   run?: (cmd: readonly string[]) => Promise<number>;
+  /**
+   * Test seam: provision a vault for the already-supervised short-circuit in
+   * `handleSetupVaultPost`. Production omits this and uses the real
+   * {@link provisionVault} (which shells to `parachute-vault create <name>
+   * --json`). Tests inject a stub so the short-circuit can be asserted without
+   * spawning the vault CLI.
+   */
+  provisionVaultImpl?: typeof provisionVault;
   /**
    * Test seam: stub the bun-link detection used by `runInstall` to
    * short-circuit `bun add -g` when a package is already linked
@@ -2305,45 +2333,130 @@ export async function handleSetupVaultPost(req: Request, deps: SetupWizardDeps):
   const registry = deps.registry;
   const vaultSpec = specFor(FIRST_VAULT_SHORT);
 
-  // Idempotent short-circuit: if the supervisor is already running (or
-  // mid-spawn) for vault — i.e. a previous POST already kicked off
-  // `runInstall` and beat us to spawning — return a synthesized
-  // succeeded op instead of firing a second `bun add -g`. Mirrors the
-  // pattern in `handleInstall` (api-modules-ops.ts). Without this,
-  // two concurrent POSTs both pass `state.hasVault === false` (the
-  // services.json seed is the only signal that step exits, and it's
-  // written by `runInstall` *after* `bun add` returns), and each
-  // fires its own install — wasted work and a possible race on the
-  // seed/spawn writes. Low risk on first-boot in practice, but the
-  // fix is cheap and matches the API surface's posture.
+  // Already-supervised handling: is the vault MODULE child already under the
+  // supervisor (running / starting / restarting)? Two ways that happens:
+  //   (a) the concurrent-POST race this guard was written for — a prior POST
+  //       already fired `runInstall` and beat us to spawning the module; and
+  //   (b) the boot-spawned-child case the Tier-1 e2e exposed — the hub started
+  //       the vault module on boot so it could `selfRegister`, but NO vault
+  //       INSTANCE has been created yet (its services.json row carries
+  //       `paths: []`, which is exactly why `hasRealVault` was false above and
+  //       we reached this create path).
+  // When the module is already supervised we must NOT fire a second
+  // `bun add -g` / `runInstall`. The three create/import sub-cases are handled
+  // below (import → reject; create+registered → provision the instance;
+  // create+unregistered → let the in-flight install create it).
   const supervisorState = deps.supervisor.get(FIRST_VAULT_SHORT);
-  if (
+  const alreadySupervised =
     supervisorState?.status === "running" ||
     supervisorState?.status === "starting" ||
-    supervisorState?.status === "restarting"
-  ) {
+    supervisorState?.status === "restarting";
+
+  // MUST-FIX (review of #768): import-during-setup on an already-supervised box
+  // isn't supported yet. On such a box (now the normal init'd-box path that
+  // reaches this vault form) `provisionVault` only creates an EMPTY vault —
+  // running it for an IMPORT request and reporting success would leave the
+  // operator with an empty vault named after their import target plus a false
+  // "vault created" banner (a data-integrity footgun). Reject with an
+  // actionable message instead. Known limitation — see CHANGELOG; the fuller
+  // fix (run the mirror-import follow-up after provision) is deferred because
+  // it isn't exercised by the e2e and can't be verified end-to-end here.
+  if (alreadySupervised && rawMode === "import") {
+    const detail =
+      "importing a vault during setup isn't supported yet on a box whose vault module is already running. Create the vault here instead, then import into it with `parachute vault …` or the admin UI.";
     if (registry) {
-      const op = registry.create("install", FIRST_VAULT_SHORT);
+      const rejectOp = registry.create("install", FIRST_VAULT_SHORT);
       registry.update(
-        op.id,
-        { status: "succeeded" },
-        `${FIRST_VAULT_SHORT} already supervised (status=${supervisorState.status})`,
+        rejectOp.id,
+        { status: "failed", error: detail },
+        `vault import unsupported on an already-supervised box: ${detail}`,
       );
       if (form.isJson) {
-        return jsonOkResponse({ op_id: op.id, step: "vault", message: "vault already supervised" });
+        return jsonOkResponse({ op_id: rejectOp.id, step: "vault", message: detail });
       }
-      return redirect(`/admin/setup?op=${encodeURIComponent(op.id)}`);
+      return redirect(`/admin/setup?op=${encodeURIComponent(rejectOp.id)}`);
     }
     if (form.isJson) {
-      return jsonOkResponse({ step: "vault", message: "vault already supervised" });
+      return jsonErrorResponse(409, "Import not supported here", detail);
     }
-    return redirect("/admin/setup");
+    return badRequestPage("Import not supported here", detail);
   }
 
+  // NIT (reviewer N2): only provision if vault is ALREADY registered in
+  // services.json. If it isn't, we're in the narrow pre-seed window of a
+  // CONCURRENT create POST whose `runInstall` spawned the module but hasn't
+  // written its row yet — firing `provisionVault` here would run
+  // `parachute install vault` a SECOND time. In that case we synthesize
+  // success below and let the in-flight install create the vault.
+  const vaultAlreadyRegistered =
+    findService(vaultSpec.manifestName, deps.manifestPath) !== undefined;
+
   const op = registry
     ? registry.create("install", FIRST_VAULT_SHORT)
     : { id: cryptoRandomId(), status: "pending" as const, log: [] as string[] };
-  if (registry) {
+
+  if (alreadySupervised && vaultAlreadyRegistered) {
+    // Case (b): supervised module, real-version row with `paths: []` (no
+    // instance). Provision the named vault via the shipped admin-SPA path
+    // (`parachute-vault create <name> --json`, idempotent + name-validated).
+    // FIRE-AND-FORGET, matching the normal `void runInstall` path: return the
+    // op_id immediately and mark the op from the BACKGROUND result. This keeps
+    // the POST fast so the CLI's 30s per-request ceiling only bounds the quick
+    // POST/poll round-trip — a slow cold `parachute-vault create` on a sluggish
+    // VPS is polled to completion within POLL_TIMEOUT_MS (5 min), never aborted
+    // mid-create. No `bun add -g` fires (module already supervised).
+    const provision = deps.provisionVaultImpl ?? provisionVault;
+    if (registry) {
+      registry.update(
+        op.id,
+        { status: "running" },
+        `${FIRST_VAULT_SHORT} already supervised (status=${supervisorState?.status}) — creating vault "${vaultName}"`,
+      );
+      void provision(vaultName, { issuer: deps.issuer, manifestPath: deps.manifestPath })
+        .then((provisioned) => {
+          if (provisioned.ok) {
+            registry.update(
+              op.id,
+              { status: "succeeded" },
+              provisioned.created
+                ? `vault "${vaultName}" created`
+                : `vault "${vaultName}" already exists`,
+            );
+          } else {
+            registry.update(
+              op.id,
+              { status: "failed", error: provisioned.message },
+              `vault create failed: ${provisioned.message}`,
+            );
+          }
+        })
+        .catch((err) => {
+          const msg = err instanceof Error ? err.message : String(err);
+          registry.update(op.id, { status: "failed", error: msg }, `vault create failed: ${msg}`);
+        });
+    } else {
+      // No registry (test-only path): provision synchronously so the vault is
+      // actually created; there's no op to poll.
+      const provisioned = await provision(vaultName, {
+        issuer: deps.issuer,
+        manifestPath: deps.manifestPath,
+      });
+      if (!provisioned.ok) {
+        console.warn(`[setup-wizard] vault create failed: ${provisioned.message}`);
+      }
+    }
+  } else if (alreadySupervised) {
+    // Case (a): supervised but NOT yet registered — the pre-seed window of a
+    // concurrent create POST. Synthesize success; the in-flight `runInstall`
+    // creates the vault (reviewer N2 — the original guard's job).
+    if (registry) {
+      registry.update(
+        op.id,
+        { status: "succeeded" },
+        `${FIRST_VAULT_SHORT} already supervised (status=${supervisorState?.status}) — a concurrent install is provisioning the vault`,
+      );
+    }
+  } else if (registry) {
     // hub#267: thread the typed name through `PARACHUTE_VAULT_NAME` so
     // vault's first-boot path (vault#342) names the created vault
     // accordingly.

package/src/surface-notes-alias.ts

@@ -0,0 +1,126 @@
+/**
+ * `/surface/notes` → `/surface/parachute` conditional alias (W2-12).
+ *
+ * The app's surface identity renamed from `notes` to `parachute`
+ * (parachute-app W2-12): a FUTURE install of the renamed surface package
+ * mounts at `/surface/parachute`, while every EXISTING install keeps
+ * serving notes-ui at `/surface/notes` — mounts are per-install on-disk
+ * identities, so nothing moves until an operator re-installs.
+ *
+ * The failure this alias exists for: an in-place upgrade that re-adds the
+ * renamed package over an existing `notes` instance flips the mount to
+ * `/surface/parachute`, orphaning every `/surface/notes/*` bookmark, PWA
+ * install, and in-vault link. This helper is the safety net — when (and
+ * only when) the manifest shows the legacy mount GONE and the new mount
+ * PRESENT, `/surface/notes/*` 301s to `/surface/parachute/*` with the
+ * sub-path tail and query string preserved.
+ *
+ * Condition — decided on the `uis{}` sub-units' **mount paths**, not their
+ * map keys:
+ *
+ *   - fire  ⇔ no `uis{}` sub-unit (across every services.json row) is
+ *             mounted at or under `/surface/notes`, AND some sub-unit is
+ *             mounted at exactly `/surface/parachute`.
+ *
+ * The W2-12 plan phrased this as "uis has no `notes` key and has a
+ * `parachute` key". Keys and paths coincide in the default install shape
+ * (surface-host keys `uis{}` by the surface's effective `meta.name` and
+ * defaults the mount to `/surface/<name>` — see parachute-surface
+ * admin-routes.ts `buildUisExtraField`), but they diverge exactly in the
+ * scenario this alias protects: re-adding the renamed package with
+ * `instance_name=notes` and no `mount_path` keeps the key `notes` while
+ * the PATH flips to `/surface/parachute`. A key-based condition would sit
+ * inert there and let the bookmarks 404; the path-based condition asks the
+ * routing question directly (the same `ui.path` values `resolveUiMount`
+ * matches on), so it fires precisely when `/surface/notes` stopped
+ * resolving and `/surface/parachute` started. It also can never redirect
+ * INTO a 404: the target mount's existence is part of the condition.
+ *
+ * INERT TODAY on every live install, on both branches of the condition:
+ * an existing notes-ui install either carries a `uis{}` sub-unit mounted
+ * at `/surface/notes` (legacy-mount-present → no redirect) or — as on
+ * installs whose surface-host row predates `uis{}` self-registration —
+ * carries no `/surface/parachute` mount (new-mount-absent → no redirect).
+ * Nothing fires until a surface actually registers at `/surface/parachute`.
+ *
+ * Dispatch placement (hub-server.ts): immediately BEFORE the generic
+ * services.json proxy — the same spot in the order where `resolveUiMount`
+ * reads the manifest — so every hub-owned prefix has had its turn and a
+ * live `/surface/notes` mount is never preempted (the condition already
+ * guarantees that, but the ordering keeps the alias out of the hot path
+ * for all non-`/surface/notes` traffic).
+ *
+ * Relationship to `notes-redirect.ts`: that module bridges the OLDER
+ * `/notes/*` → `/surface/notes/*` rename (notes-as-app Phase 2) and is
+ * untouched by W2-12 — its target keeps serving notes-ui on existing
+ * installs. On a post-rename install the two compose: `/notes/x` → 301
+ * `/surface/notes/x` → 301 `/surface/parachute/x`.
+ */
+
+import type { ServiceEntry } from "./services-manifest.ts";
+
+/** The legacy mount — the app's pre-W2-12 surface identity (notes-ui). */
+export const LEGACY_SURFACE_NOTES_MOUNT = "/surface/notes";
+
+/** The app's surface mount — the post-W2-12 identity. */
+export const APP_SURFACE_PARACHUTE_MOUNT = "/surface/parachute";
+
+/**
+ * Matches the legacy app-surface mount: bare `/surface/notes`, the
+ * trailing-slash form, and any sub-path. Boundary-checked — `/surface/notesy`
+ * and `/surface/notes-archive` do NOT match. Same shape as
+ * `isLegacyNotesPath` in notes-redirect.ts.
+ */
+export function isSurfaceNotesPath(pathname: string): boolean {
+  return (
+    pathname === LEGACY_SURFACE_NOTES_MOUNT || pathname.startsWith(`${LEGACY_SURFACE_NOTES_MOUNT}/`)
+  );
+}
+
+/**
+ * Decide whether a `/surface/notes*` request should 301 to the
+ * `/surface/parachute*` twin. Returns the target (path + preserved query)
+ * when the condition holds, `undefined` otherwise.
+ *
+ * `services` is the lenient manifest read (`readManifestLenient(...).services`)
+ * — the same source `resolveUiMount` consumes, re-read per request so the
+ * alias tracks a surface-host re-registration without a hub restart.
+ *
+ * Normalization mirrors `resolveUiMount`: trailing slashes stripped before
+ * comparison. The legacy-mount check treats a sub-unit mounted at OR UNDER
+ * `/surface/notes` as "the legacy identity still resolves" (a deeper mount
+ * like `/surface/notes/foo` would still serve real content under the
+ * prefix — redirecting across it would hijack a live route). The target
+ * check requires an EXACT `/surface/parachute` mount — a deeper-only mount
+ * would leave the redirect landing on a 404, which this alias exists to
+ * prevent, not cause.
+ */
+export function maybeRedirectSurfaceNotes(
+  pathname: string,
+  search: string,
+  services: readonly ServiceEntry[],
+): string | undefined {
+  if (!isSurfaceNotesPath(pathname)) return undefined;
+
+  let legacyMountResolves = false;
+  let appMountPresent = false;
+  for (const entry of services) {
+    if (!entry.uis) continue;
+    for (const ui of Object.values(entry.uis)) {
+      const norm = ui.path.replace(/\/+$/, "") || "/";
+      if (
+        norm === LEGACY_SURFACE_NOTES_MOUNT ||
+        norm.startsWith(`${LEGACY_SURFACE_NOTES_MOUNT}/`)
+      ) {
+        legacyMountResolves = true;
+      }
+      if (norm === APP_SURFACE_PARACHUTE_MOUNT) {
+        appMountPresent = true;
+      }
+    }
+  }
+  if (legacyMountResolves || !appMountPresent) return undefined;
+
+  const tail = pathname.slice(LEGACY_SURFACE_NOTES_MOUNT.length);
+  return `${APP_SURFACE_PARACHUTE_MOUNT}${tail}${search}`;
+}

package/src/__tests__/admin-agent-token.test.ts

@@ -1,173 +0,0 @@
-/**
- * Tests for the agent UI session→bearer mint endpoint. Mirrors
- * `admin-host-admin-token.test.ts` shape (agent has a single bare audience,
- * no per-vault name). Covers:
- *   - 401 when no admin session cookie is present.
- *   - 401 when the cookie names a deleted session.
- *   - 405 on POST.
- *   - 200 + JWT carrying `aud: "agent"` and `agent:read agent:send agent:admin`.
- *   - First-admin gate: 403 for a signed-in non-first-admin (friend); the
- *     admin's happy path still mints when a friend exists alongside.
- */
-import type { Database } from "bun:sqlite";
-import { afterEach, beforeEach, describe, expect, test } from "bun:test";
-import { mkdtempSync, rmSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { AGENT_TOKEN_TTL_SECONDS, handleAgentToken } from "../admin-agent-token.ts";
-import { hubDbPath, openHubDb } from "../hub-db.ts";
-import { validateAccessToken } from "../jwt-sign.ts";
-import { SESSION_TTL_MS, buildSessionCookie, createSession, deleteSession } from "../sessions.ts";
-import { rotateSigningKey } from "../signing-keys.ts";
-import { createUser } from "../users.ts";
-
-const ISSUER = "https://hub.test";
-
-interface Harness {
-  db: Database;
-  cleanup: () => void;
-}
-
-function makeHarness(): Harness {
-  const dir = mkdtempSync(join(tmpdir(), "phub-agent-token-"));
-  const db = openHubDb(hubDbPath(dir));
-  return {
-    db,
-    cleanup: () => {
-      db.close();
-      rmSync(dir, { recursive: true, force: true });
-    },
-  };
-}
-
-let harness: Harness;
-beforeEach(() => {
-  harness = makeHarness();
-});
-afterEach(() => {
-  harness.cleanup();
-});
-
-async function withSession(): Promise<{ cookie: string; userId: string }> {
-  const user = await createUser(harness.db, "operator", "hunter2");
-  const session = createSession(harness.db, { userId: user.id });
-  const cookie = buildSessionCookie(session.id, Math.floor(SESSION_TTL_MS / 1000));
-  return { cookie, userId: user.id };
-}
-
-/**
- * Seed an admin (first-created user) + a second non-admin "friend" account,
- * return cookies + ids for both. Used by the first-admin-gate tests.
- */
-async function withAdminAndFriend(): Promise<{
-  adminCookie: string;
-  adminId: string;
-  friendCookie: string;
-  friendId: string;
-}> {
-  const admin = await createUser(harness.db, "admin", "admin-passphrase");
-  const friend = await createUser(harness.db, "alice", "alice-passphrase", {
-    allowMulti: true,
-  });
-  const adminSession = createSession(harness.db, { userId: admin.id });
-  const friendSession = createSession(harness.db, { userId: friend.id });
-  return {
-    adminCookie: buildSessionCookie(adminSession.id, Math.floor(SESSION_TTL_MS / 1000)),
-    adminId: admin.id,
-    friendCookie: buildSessionCookie(friendSession.id, Math.floor(SESSION_TTL_MS / 1000)),
-    friendId: friend.id,
-  };
-}
-
-describe("handleAgentToken", () => {
-  test("401 when no session cookie is present", async () => {
-    const req = new Request(`${ISSUER}/admin/agent-token`);
-    const res = await handleAgentToken(req, { db: harness.db, issuer: ISSUER });
-    expect(res.status).toBe(401);
-    const body = (await res.json()) as { error: string };
-    expect(body.error).toBe("unauthenticated");
-  });
-
-  test("401 when the cookie names a deleted session", async () => {
-    const { cookie } = await withSession();
-    const sid = cookie.match(/parachute_hub_session=([^;]+)/)?.[1] ?? "";
-    deleteSession(harness.db, sid);
-    const req = new Request(`${ISSUER}/admin/agent-token`, { headers: { cookie } });
-    const res = await handleAgentToken(req, { db: harness.db, issuer: ISSUER });
-    expect(res.status).toBe(401);
-  });
-
-  test("405 on POST", async () => {
-    const { cookie } = await withSession();
-    const req = new Request(`${ISSUER}/admin/agent-token`, {
-      method: "POST",
-      headers: { cookie },
-    });
-    const res = await handleAgentToken(req, { db: harness.db, issuer: ISSUER });
-    expect(res.status).toBe(405);
-  });
-
-  test("200 mints a JWT carrying aud:agent + agent:read agent:send agent:admin", async () => {
-    const { cookie, userId } = await withSession();
-    rotateSigningKey(harness.db);
-    const req = new Request(`${ISSUER}/admin/agent-token`, { headers: { cookie } });
-    const res = await handleAgentToken(req, { db: harness.db, issuer: ISSUER });
-    expect(res.status).toBe(200);
-    expect(res.headers.get("cache-control")).toBe("no-store");
-
-    const body = (await res.json()) as { token: string; expires_at: string; scopes: string[] };
-    // `agent:send` (post) + `agent:read` (SSE replies) + `agent:admin`
-    // (config UI list/edit — 2026-06-09 modular-UI architecture P3). Deliberately
-    // NOT `agent:write` — that's the session-reply scope a UI token must not hold.
-    expect(body.scopes).toEqual(["agent:read", "agent:send", "agent:admin"]);
-    expect(body.scopes).not.toContain("agent:write");
-    expect(body.token.length).toBeGreaterThan(20);
-
-    const expMs = new Date(body.expires_at).getTime();
-    const skew = expMs - Date.now();
-    expect(skew).toBeGreaterThan((AGENT_TOKEN_TTL_SECONDS - 30) * 1000);
-    expect(skew).toBeLessThan((AGENT_TOKEN_TTL_SECONDS + 30) * 1000);
-
-    const validated = await validateAccessToken(harness.db, body.token, ISSUER);
-    expect(validated.payload.sub).toBe(userId);
-    expect(validated.payload.iss).toBe(ISSUER);
-    // Bare service audience — agent validates `aud === "agent"`
-    // (parachute-agent src/hub-jwt.ts).
-    expect(validated.payload.aud).toBe("agent");
-    const scopeClaim = (validated.payload as { scope?: string }).scope ?? "";
-    const scopes = scopeClaim.split(/\s+/);
-    expect(scopes).toContain("agent:read");
-    expect(scopes).toContain("agent:send");
-    expect(scopes).toContain("agent:admin");
-    expect(scopes).not.toContain("agent:write");
-  });
-
-  test("403 not_admin when a signed-in non-first-admin (friend) hits the endpoint", async () => {
-    // Privesc closure (mirrors host/vault-admin-token). The friend's session
-    // is valid; the endpoint must refuse because session.userId isn't the
-    // first-admin row.
-    const { friendCookie } = await withAdminAndFriend();
-    rotateSigningKey(harness.db);
-    const req = new Request(`${ISSUER}/admin/agent-token`, {
-      headers: { cookie: friendCookie },
-    });
-    const res = await handleAgentToken(req, { db: harness.db, issuer: ISSUER });
-    expect(res.status).toBe(403);
-    const body = (await res.json()) as { error: string; error_description: string };
-    expect(body.error).toBe("not_admin");
-    expect(body.error_description).toContain("/account/");
-  });
-
-  test("first-admin path still succeeds when a friend exists alongside", async () => {
-    const { adminCookie, adminId } = await withAdminAndFriend();
-    rotateSigningKey(harness.db);
-    const req = new Request(`${ISSUER}/admin/agent-token`, {
-      headers: { cookie: adminCookie },
-    });
-    const res = await handleAgentToken(req, { db: harness.db, issuer: ISSUER });
-    expect(res.status).toBe(200);
-    const body = (await res.json()) as { token: string };
-    const validated = await validateAccessToken(harness.db, body.token, ISSUER);
-    expect(validated.payload.sub).toBe(adminId);
-  });
-});