@openparachute/hub 0.7.7-rc.9 → 0.7.7

package/src/__tests__/chrome-strip.test.ts

@@ -99,6 +99,20 @@ describe("shouldInjectChrome", () => {
     expect(shouldInjectChrome("/surface/notes-archive/")).toBe(true);
   });
 
+  test("default: opts out the app's surface mount at /surface/parachute/* (W2-12)", () => {
+    expect(shouldInjectChrome("/surface/parachute")).toBe(false);
+    expect(shouldInjectChrome("/surface/parachute/")).toBe(false);
+    expect(shouldInjectChrome("/surface/parachute/index.html")).toBe(false);
+    expect(shouldInjectChrome("/surface/parachute/assets/index-XXX.js")).toBe(false);
+  });
+
+  test("the /surface/parachute/ opt-out does not over-match sibling paths", () => {
+    // `/surface/parachutes` must NOT match `/surface/parachute/` — the slash
+    // boundary check applies to the new entry the same as the legacy one.
+    expect(shouldInjectChrome("/surface/parachutes")).toBe(true);
+    expect(shouldInjectChrome("/surface/parachute-club/")).toBe(true);
+  });
+
   test("custom opt-out list is honored", () => {
     expect(shouldInjectChrome("/foo/bar", ["/foo/"])).toBe(false);
     expect(shouldInjectChrome("/baz", ["/foo/"])).toBe(true);
@@ -111,8 +125,11 @@ describe("shouldInjectChrome", () => {
     expect(shouldInjectChrome("/foo/bar", ["/foo"])).toBe(false);
   });
 
-  test("the canonical opt-out list contains /surface/notes/", () => {
+  test("the canonical opt-out list contains BOTH /surface/notes/ and /surface/parachute/", () => {
+    // W2-12 is additive: the legacy notes-ui mount keeps its opt-out for
+    // existing installs; the renamed app-surface mount gets its own.
     expect(CHROME_OPT_OUT_PREFIXES).toContain("/surface/notes/");
+    expect(CHROME_OPT_OUT_PREFIXES).toContain("/surface/parachute/");
   });
 });
 

package/src/__tests__/doctor.test.ts

@@ -502,7 +502,7 @@ describe("doctor — canonical-port-drift detection (read-only)", () => {
   test("a non-canonical port + a duplicate-port pair → port-drift WARNs naming the services", async () => {
     const h = makeHarness();
     try {
-      // scribe drifted off 1943 onto 1944; agent also squats 1944 (a collision).
+      // Scribe drifted off 1943 onto Surface's canonical 1946 (a collision).
       writeManifestRows(h.manifestPath, [
         {
           name: "parachute-vault",
@@ -511,21 +511,17 @@ describe("doctor — canonical-port-drift detection (read-only)", () => {
           health: "/h",
           version: "1",
         },
-        { name: "parachute-scribe", port: 1944, paths: ["/scribe"], health: "/h", version: "1" },
-        { name: "parachute-agent", port: 1944, paths: ["/agent"], health: "/h", version: "1" },
+        { name: "parachute-scribe", port: 1946, paths: ["/scribe"], health: "/h", version: "1" },
+        { name: "parachute-surface", port: 1946, paths: ["/surface"], health: "/h", version: "1" },
       ]);
       seedOperatorToken(h.configDir);
       const { code, checks } = await runDoctor(h, healthyDeps());
       const pd = byName(checks, "port-drift");
       expect(pd?.status).toBe("warn");
-      // Names the drifted service AND the colliding pair.
       expect(pd?.detail).toContain("scribe");
-      expect(pd?.detail).toContain("1944");
-      expect(pd?.detail).toContain("parachute-scribe + parachute-agent");
+      expect(pd?.detail).toContain("1946");
+      expect(pd?.detail).toContain("parachute-scribe + parachute-surface");
       expect(pd?.fix).toBe("parachute doctor --fix");
-      // Drift is advisory — exit stays 0 (a WARN, not a FAIL). The duplicate
-      // rows also trip modules-alive (both can't bind 1944) but that's expected
-      // for this fixture; we only assert on port-drift here.
       expect([0, 1]).toContain(code);
     } finally {
       h.cleanup();
@@ -732,22 +728,19 @@ describe("doctor --fix — canonical-port repair (confirm-gated, idempotent, non
   test("--fix reports a duplicate-port collision but does not auto-resolve it", async () => {
     const h = makeHarness();
     try {
-      // Two services collide on 1944; neither is on its canonical slot. The
-      // diff fixes the canonical drift; the collision is reported, not guessed.
+      // Two supported services collide on unassigned 1945; both are off canonical.
       writeManifestRows(h.manifestPath, [
-        { name: "parachute-scribe", port: 1944, paths: ["/scribe"], health: "/h", version: "1" },
-        { name: "parachute-agent", port: 1944, paths: ["/agent"], health: "/h", version: "1" },
+        { name: "parachute-scribe", port: 1945, paths: ["/scribe"], health: "/h", version: "1" },
+        { name: "parachute-surface", port: 1945, paths: ["/surface"], health: "/h", version: "1" },
       ]);
       const { code, lines } = await runFix(h, {}, { yes: true });
       const text = lines.join("\n");
       expect(text.toLowerCase()).toContain("shared by");
-      expect(text).toContain("parachute-scribe + parachute-agent");
-      // scribe → 1943 and agent → 1941 are both off 1944, so after the rewrite
-      // they no longer collide; fix applied, exit 0.
+      expect(text).toContain("parachute-scribe + parachute-surface");
       expect(code).toBe(0);
       const rows = readRows(h.manifestPath);
       expect(rows.find((r) => r.name === "parachute-scribe")?.port).toBe(1943);
-      expect(rows.find((r) => r.name === "parachute-agent")?.port).toBe(1941);
+      expect(rows.find((r) => r.name === "parachute-surface")?.port).toBe(1946);
     } finally {
       h.cleanup();
     }

package/src/__tests__/hub-command.test.ts

@@ -12,9 +12,15 @@ import { afterEach, beforeEach, describe, expect, test } from "bun:test";
 import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { hub, hubSetOrigin, hubSetRootRedirect, rewriteCaddyfileHost } from "../commands/hub.ts";
+import {
+  hub,
+  hubSetOrigin,
+  hubSetRootMode,
+  hubSetRootRedirect,
+  rewriteCaddyfileHost,
+} from "../commands/hub.ts";
 import { hubDbPath, openHubDb } from "../hub-db.ts";
-import { getHubOrigin, getRootRedirect } from "../hub-settings.ts";
+import { getHubOrigin, getRootMode, getRootRedirect } from "../hub-settings.ts";
 import type { CommandResult } from "../tailscale/run.ts";
 
 describe("parachute hub set-origin", () => {
@@ -498,3 +504,65 @@ describe("parachute hub set-root-redirect", () => {
     expect(persisted()).toBe("/surface/via-dispatcher");
   });
 });
+
+describe("parachute hub set-root-mode", () => {
+  let dir: string;
+  let log: string[];
+  const collect = (line: string) => log.push(line);
+
+  beforeEach(() => {
+    dir = mkdtempSync(join(tmpdir(), "hub-set-root-mode-"));
+    log = [];
+  });
+  afterEach(() => rmSync(dir, { recursive: true, force: true }));
+
+  function persisted(): string | null {
+    const db = openHubDb(hubDbPath(dir));
+    try {
+      return getRootMode(db);
+    } finally {
+      db.close();
+    }
+  }
+
+  test("persists serve-app to hub_settings.root_mode", async () => {
+    const code = await hubSetRootMode(["serve-app"], { configDir: dir, log: collect });
+    expect(code).toBe(0);
+    expect(persisted()).toBe("serve-app");
+    expect(log.join("\n")).toMatch(/serves the Parachute app/);
+  });
+
+  test("`redirect` stores as absence (the default), clearing any row", async () => {
+    await hubSetRootMode(["serve-app"], { configDir: dir, log: collect });
+    const code = await hubSetRootMode(["redirect"], { configDir: dir, log: collect });
+    expect(code).toBe(0);
+    expect(persisted()).toBeNull();
+  });
+
+  test("--clear deletes the row", async () => {
+    await hubSetRootMode(["serve-app"], { configDir: dir, log: collect });
+    const code = await hubSetRootMode(["--clear"], { configDir: dir, log: collect });
+    expect(code).toBe(0);
+    expect(persisted()).toBeNull();
+  });
+
+  test("rejects an unknown mode without writing", async () => {
+    for (const bad of ["serveapp", "SERVE-APP", "app", "/surface/x"]) {
+      const code = await hubSetRootMode([bad], { configDir: dir, log: collect });
+      expect(code).toBe(1);
+      expect(persisted()).toBeNull();
+    }
+  });
+
+  test("usage error (exit 1) when no mode + no --clear", async () => {
+    const code = await hubSetRootMode([], { configDir: dir, log: collect });
+    expect(code).toBe(1);
+    expect(persisted()).toBeNull();
+  });
+
+  test("routed through the `hub` dispatcher", async () => {
+    const code = await hub(["set-root-mode", "serve-app"], { configDir: dir, log: collect });
+    expect(code).toBe(0);
+    expect(persisted()).toBe("serve-app");
+  });
+});

package/src/__tests__/hub-server.test.ts

@@ -17,7 +17,7 @@ import {
   resolveClientIp,
   stripHopByHopHeaders,
 } from "../hub-server.ts";
-import { setNotesRedirectDisabled } from "../hub-settings.ts";
+import { setNotesRedirectDisabled, setRootMode } from "../hub-settings.ts";
 import { clearNotesRedirectLogState } from "../notes-redirect.ts";
 import { mintOperatorToken } from "../operator-token.ts";
 import { pidPath } from "../process-state.ts";
@@ -993,6 +993,29 @@ describe("hubFetch routing", () => {
     }
   });
 
+  test("retired Agent token endpoints neither mint nor redirect", async () => {
+    const h = makeHarness();
+    try {
+      const dist = join(h.dir, "dist");
+      mkdirIfMissing(dist);
+      writeFileSync(join(dist, "index.html"), "<!doctype html><title>admin shell</title>");
+      const fetcher = hubFetch(h.dir, { spaDistDir: dist });
+
+      for (const path of ["/admin/agent-token", "/admin/channel-token"]) {
+        const post = await fetcher(req(path, { method: "POST" }));
+        expect(post.status).toBe(405);
+        expect(post.headers.get("location")).toBeNull();
+
+        const get = await fetcher(req(path));
+        expect(get.status).toBe(200);
+        expect(get.headers.get("location")).toBeNull();
+        expect(await get.text()).toContain("admin shell");
+      }
+    } finally {
+      h.cleanup();
+    }
+  });
+
   // 301 back-compat redirects (closes hub#231): pre-rename SPA URLs
   // 301-redirect to the new /admin/* mount. Tests cover every entry in the
   // dispatch — operator bookmarks landing on any of these still work.
@@ -1249,6 +1272,20 @@ describe("hubFetch routing", () => {
     }
   });
 
+  test("retired /channel/* paths no longer redirect to /agent/*", async () => {
+    const h = makeHarness();
+    try {
+      writeManifest({ services: [] }, h.manifestPath);
+      const res = await hubFetch(h.dir, { manifestPath: h.manifestPath })(
+        req("/channel/mcp/default?q=1"),
+      );
+      expect(res.status).toBe(404);
+      expect(res.headers.get("location")).toBeNull();
+    } finally {
+      h.cleanup();
+    }
+  });
+
   test("/hub/<unknown> (no SPA mount anymore) → 404", async () => {
     const h = makeHarness();
     try {
@@ -6381,3 +6418,287 @@ describe("hubFetch proxied-page security headers (hub#643 Tier-1)", () => {
     }
   });
 });
+
+// root_mode = serve-app: the hub serves the installed app's dist AT `/`, with
+// the fresh-hub funnel + pre-admin 503 + every hub-owned route preempting it.
+describe("hubFetch — root_mode serve-app", () => {
+  // A fixture app dist (index.html + assets). Distinct marker text so a test can
+  // tell an app-served body from an admin-SPA / discovery body.
+  function makeAppDist(dir: string): string {
+    const dist = join(dir, "app-dist");
+    mkdirSync(join(dist, "assets"), { recursive: true });
+    writeFileSync(join(dist, "index.html"), "<!doctype html><title>PARACHUTE-APP-SHELL</title>");
+    writeFileSync(join(dist, "assets", "app-xyz.js"), "console.log('serve-app')");
+    writeFileSync(join(dist, "manifest.webmanifest"), '{"name":"Parachute"}');
+    return dist;
+  }
+
+  // A distinct admin-SPA fixture so `/admin` reachability is provable (its body
+  // must NOT be the app shell).
+  function makeAdminDist(dir: string): string {
+    const dist = join(dir, "admin-dist");
+    mkdirSync(dist, { recursive: true });
+    writeFileSync(join(dist, "index.html"), "<!doctype html><title>ADMIN-SPA</title>");
+    return dist;
+  }
+
+  // Seed admin + a vault so the fresh-hub wizard funnel is bypassed (the
+  // "setup complete" state where serve-app should actually engage).
+  async function setupCompleteDb(h: Harness): Promise<ReturnType<typeof openHubDb>> {
+    writeManifest({ services: [vaultEntry("default")] }, h.manifestPath);
+    const db = openHubDb(hubDbPath(h.dir));
+    await createUser(db, "owner", "pw");
+    return db;
+  }
+
+  test("serves the app index.html at `/` (200, text/html, no redirect, no chrome)", async () => {
+    const h = makeHarness();
+    const db = await setupCompleteDb(h);
+    try {
+      setRootMode(db, "serve-app");
+      const dist = makeAppDist(h.dir);
+      const res = await hubFetch(h.dir, {
+        getDb: () => db,
+        manifestPath: h.manifestPath,
+        resolveAppDist: () => dist,
+      })(req("/"));
+      expect(res.status).toBe(200);
+      expect(res.headers.get("content-type")).toContain("text/html");
+      const body = await res.text();
+      expect(body).toContain("PARACHUTE-APP-SHELL");
+      // No identity chrome injected on the root-served app HTML.
+      expect(body).not.toContain('class="auth-indicator"');
+    } finally {
+      db.close();
+      h.cleanup();
+    }
+  });
+
+  test("serves an app asset from dist (/assets/*) with an inferred content-type", async () => {
+    const h = makeHarness();
+    const db = await setupCompleteDb(h);
+    try {
+      setRootMode(db, "serve-app");
+      const dist = makeAppDist(h.dir);
+      const res = await hubFetch(h.dir, {
+        getDb: () => db,
+        manifestPath: h.manifestPath,
+        resolveAppDist: () => dist,
+      })(req("/assets/app-xyz.js", { headers: { accept: "*/*" } }));
+      expect(res.status).toBe(200);
+      expect(res.headers.get("content-type") ?? "").toMatch(/javascript/);
+      expect(await res.text()).toContain("serve-app");
+    } finally {
+      db.close();
+      h.cleanup();
+    }
+  });
+
+  test("SPA-fallback: an unclaimed HTML deep link gets the app shell", async () => {
+    const h = makeHarness();
+    const db = await setupCompleteDb(h);
+    try {
+      setRootMode(db, "serve-app");
+      const dist = makeAppDist(h.dir);
+      const res = await hubFetch(h.dir, {
+        getDb: () => db,
+        manifestPath: h.manifestPath,
+        resolveAppDist: () => dist,
+      })(req("/some/app/deep/link", { headers: { accept: "text/html" } }));
+      expect(res.status).toBe(200);
+      expect(await res.text()).toContain("PARACHUTE-APP-SHELL");
+    } finally {
+      db.close();
+      h.cleanup();
+    }
+  });
+
+  test("a non-HTML unclaimed path keeps the branded 404 (not the app shell)", async () => {
+    const h = makeHarness();
+    const db = await setupCompleteDb(h);
+    try {
+      setRootMode(db, "serve-app");
+      const dist = makeAppDist(h.dir);
+      const res = await hubFetch(h.dir, {
+        getDb: () => db,
+        manifestPath: h.manifestPath,
+        resolveAppDist: () => dist,
+      })(req("/definitely/not/a/file.json", { headers: { accept: "application/json" } }));
+      expect(res.status).toBe(404);
+    } finally {
+      db.close();
+      h.cleanup();
+    }
+  });
+
+  test("a malformed percent-encoded asset path 404s (not 500) through the real dispatch", async () => {
+    const h = makeHarness();
+    const db = await setupCompleteDb(h);
+    try {
+      setRootMode(db, "serve-app");
+      const dist = makeAppDist(h.dir);
+      // `%ZZ` is an invalid escape — decodeURIComponent throws. Without the
+      // guard in serveAppAtRoot this escapes to the dispatch outer catch → 500.
+      const res = await hubFetch(h.dir, {
+        getDb: () => db,
+        manifestPath: h.manifestPath,
+        resolveAppDist: () => dist,
+      })(req("/assets/%ZZ", { headers: { accept: "text/html" } }));
+      expect(res.status).toBe(404);
+    } finally {
+      db.close();
+      h.cleanup();
+    }
+  });
+
+  test("app-not-installed falls back to the redirect (with resolveAppDist → null)", async () => {
+    const h = makeHarness();
+    const db = await setupCompleteDb(h);
+    try {
+      setRootMode(db, "serve-app");
+      const res = await hubFetch(h.dir, {
+        getDb: () => db,
+        manifestPath: h.manifestPath,
+        resolveAppDist: () => null, // app not installed
+      })(req("/"));
+      // Falls through to the redirect (default /admin).
+      expect(res.status).toBe(302);
+      expect(res.headers.get("location")).toBe("/admin");
+    } finally {
+      db.close();
+      h.cleanup();
+    }
+  });
+
+  // --- Precedence: the funnels + hub-owned routes preempt serve-app ---------
+
+  test("fresh-hub wizard funnel WINS over serve-app (no admin → `/` 302 /admin/setup)", async () => {
+    const h = makeHarness();
+    // NO admin user, NO vault → needsWizard. serve-app is set + app resolvable.
+    const db = openHubDb(hubDbPath(h.dir));
+    try {
+      setRootMode(db, "serve-app");
+      const dist = makeAppDist(h.dir);
+      const res = await hubFetch(h.dir, {
+        getDb: () => db,
+        manifestPath: h.manifestPath,
+        resolveAppDist: () => dist,
+      })(req("/"));
+      expect(res.status).toBe(302);
+      expect(res.headers.get("location")).toBe("/admin/setup");
+    } finally {
+      db.close();
+      h.cleanup();
+    }
+  });
+
+  test("pre-admin 503 lockout WINS over serve-app (no admin → /api/* 503 setup_required)", async () => {
+    const h = makeHarness();
+    const db = openHubDb(hubDbPath(h.dir)); // no admin
+    try {
+      setRootMode(db, "serve-app");
+      const dist = makeAppDist(h.dir);
+      const res = await hubFetch(h.dir, {
+        getDb: () => db,
+        manifestPath: h.manifestPath,
+        resolveAppDist: () => dist,
+      })(req("/api/hub"));
+      expect(res.status).toBe(503);
+      const body = (await res.json()) as { error?: string };
+      expect(body.error).toBe("setup_required");
+    } finally {
+      db.close();
+      h.cleanup();
+    }
+  });
+
+  test("/admin stays reachable in serve-app mode (dispatched before the tail, not the app shell)", async () => {
+    const h = makeHarness();
+    const db = await setupCompleteDb(h);
+    try {
+      setRootMode(db, "serve-app");
+      const appDist = makeAppDist(h.dir);
+      const adminDist = makeAdminDist(h.dir);
+      const res = await hubFetch(h.dir, {
+        getDb: () => db,
+        manifestPath: h.manifestPath,
+        spaDistDir: adminDist,
+        resolveAppDist: () => appDist,
+      })(req("/admin"));
+      expect(res.status).toBe(200);
+      const body = await res.text();
+      expect(body).toContain("ADMIN-SPA");
+      expect(body).not.toContain("PARACHUTE-APP-SHELL");
+    } finally {
+      db.close();
+      h.cleanup();
+    }
+  });
+
+  test("reserved /api|/oauth|/.well-known unclaimed paths keep the branded 404 (not the app shell)", async () => {
+    const h = makeHarness();
+    const db = await setupCompleteDb(h);
+    try {
+      setRootMode(db, "serve-app");
+      const dist = makeAppDist(h.dir);
+      const handler = hubFetch(h.dir, {
+        getDb: () => db,
+        manifestPath: h.manifestPath,
+        resolveAppDist: () => dist,
+      });
+      // A browser navigation (Accept: text/html) to an unmatched /api path must
+      // NOT be shelled — it keeps the branded 404 for the API namespace.
+      const res = await handler(req("/api/nonexistent", { headers: { accept: "text/html" } }));
+      expect(res.status).toBe(404);
+      expect(await res.text()).not.toContain("PARACHUTE-APP-SHELL");
+    } finally {
+      db.close();
+      h.cleanup();
+    }
+  });
+
+  // --- Regression pin: redirect mode is byte-identical to before ------------
+
+  test("redirect mode (default) is inert even with resolveAppDist wired — `/` still 302s /admin", async () => {
+    const h = makeHarness();
+    const db = await setupCompleteDb(h); // no root_mode set → default redirect
+    try {
+      const dist = makeAppDist(h.dir);
+      const handler = hubFetch(h.dir, {
+        getDb: () => db,
+        manifestPath: h.manifestPath,
+        resolveAppDist: () => dist, // wired but must stay inert in redirect mode
+      });
+      const rootRes = await handler(req("/"));
+      expect(rootRes.status).toBe(302);
+      expect(rootRes.headers.get("location")).toBe("/admin");
+      // The 404 tail is unchanged too: an unclaimed HTML path is the branded
+      // 404 page, NOT the app shell.
+      const tailRes = await handler(req("/random/unclaimed", { headers: { accept: "text/html" } }));
+      expect(tailRes.status).toBe(404);
+      expect(await tailRes.text()).not.toContain("PARACHUTE-APP-SHELL");
+    } finally {
+      db.close();
+      h.cleanup();
+    }
+  });
+
+  test("a non-GET `/` in serve-app mode keeps its 302 (only GET serves the app)", async () => {
+    const h = makeHarness();
+    const db = await setupCompleteDb(h);
+    try {
+      setRootMode(db, "serve-app");
+      const dist = makeAppDist(h.dir);
+      const res = await hubFetch(h.dir, {
+        getDb: () => db,
+        manifestPath: h.manifestPath,
+        resolveAppDist: () => dist,
+      })(req("/", { method: "POST" }));
+      expect(res.status).toBe(302);
+      expect(res.headers.get("location")).toBe("/admin");
+    } finally {
+      db.close();
+      h.cleanup();
+    }
+  });
+});