@openparachute/hub 0.7.7-rc.9 → 0.7.7

package/src/__tests__/hub-settings.test.ts

@@ -12,30 +12,38 @@ import { join } from "node:path";
 import { hubDbPath, openHubDb } from "../hub-db.ts";
 import {
   DEFAULT_MODULE_INSTALL_CHANNEL,
+  DEFAULT_ROOT_MODE,
   DEFAULT_ROOT_REDIRECT,
   FIRST_CLIENT_AUTO_APPROVE_WINDOW_MS,
   MODULE_INSTALL_CHANNELS,
+  PARACHUTE_HUB_ROOT_MODE_ENV,
   PARACHUTE_HUB_ROOT_REDIRECT_ENV,
   PARACHUTE_INSTALL_CHANNEL_ENV,
   PARACHUTE_MODULE_CHANNEL_ENV,
+  ROOT_MODES,
   SETUP_EXPOSE_MODES,
   consumeFirstClientAutoApproveWindow,
   deleteSetting,
   getHubOrigin,
   getModuleInstallChannel,
+  getRootMode,
   getRootRedirect,
   getSetting,
   isFirstClientAutoApproveWindowOpen,
   isModuleInstallChannel,
   isNotesRedirectDisabled,
+  isRootMode,
   isSafeRedirectPath,
   isSetupExposeMode,
   openFirstClientAutoApproveWindow,
+  resolveRootMode,
+  resolveRootModeDetailed,
   resolveRootRedirect,
   resolveRootRedirectDetailed,
   setHubOrigin,
   setModuleInstallChannel,
   setNotesRedirectDisabled,
+  setRootMode,
   setRootRedirect,
   setSetting,
 } from "../hub-settings.ts";
@@ -363,9 +371,9 @@ describe("hub-settings — module install channel bootstrap", () => {
       // First read with env=rc — env wins, returns "rc". DB stays empty
       // (no auto-write to DB when env is set, per the design that
       // preserves the SPA's last-write as the env-unset fallback).
-      expect(
-        getModuleInstallChannel(db, { env: { [PARACHUTE_INSTALL_CHANNEL_ENV]: "rc" } }),
-      ).toBe("rc");
+      expect(getModuleInstallChannel(db, { env: { [PARACHUTE_INSTALL_CHANNEL_ENV]: "rc" } })).toBe(
+        "rc",
+      );
       // Second read with env=latest — env wins again (would have returned
       // "rc" under the old DB-after-first-seed behavior).
       expect(
@@ -386,9 +394,9 @@ describe("hub-settings — module install channel bootstrap", () => {
     const db = openHubDb(hubDbPath(dir));
     try {
       // PARACHUTE_INSTALL_CHANNEL — canonical name (matches install.ts).
-      expect(
-        getModuleInstallChannel(db, { env: { [PARACHUTE_INSTALL_CHANNEL_ENV]: "rc" } }),
-      ).toBe("rc");
+      expect(getModuleInstallChannel(db, { env: { [PARACHUTE_INSTALL_CHANNEL_ENV]: "rc" } })).toBe(
+        "rc",
+      );
       // PARACHUTE_MODULE_CHANNEL — legacy alias, still recognized.
       const db2 = openHubDb(join(mkdtempSync(join(tmpdir(), "phub-hsalt-")), "hub.db"));
       try {
@@ -801,3 +809,99 @@ describe("hub-settings — root_redirect storage + resolution", () => {
     expect(resolveRootRedirect(null, { env })).toBe("/surface/from-env");
   });
 });
+
+describe("hub-settings — root_mode storage + resolution", () => {
+  let dir: string;
+  beforeEach(() => {
+    dir = mkdtempSync(join(tmpdir(), "hub-settings-root-mode-"));
+  });
+  afterEach(() => rmSync(dir, { recursive: true, force: true }));
+
+  const noEnv: NodeJS.ProcessEnv = {};
+  const silent = () => {};
+
+  test("isRootMode + ROOT_MODES", () => {
+    expect(ROOT_MODES).toEqual(["redirect", "serve-app"]);
+    expect(isRootMode("redirect")).toBe(true);
+    expect(isRootMode("serve-app")).toBe(true);
+    expect(isRootMode("serveapp")).toBe(false);
+    expect(isRootMode(42)).toBe(false);
+  });
+
+  test("getRootMode round-trips serve-app via setRootMode", () => {
+    const db = openHubDb(hubDbPath(dir));
+    try {
+      expect(getRootMode(db)).toBeNull();
+      setRootMode(db, "serve-app");
+      expect(getRootMode(db)).toBe("serve-app");
+    } finally {
+      db.close();
+    }
+  });
+
+  test("setRootMode(null) and setRootMode('redirect') both clear the row (default = absence)", () => {
+    const db = openHubDb(hubDbPath(dir));
+    try {
+      setRootMode(db, "serve-app");
+      setRootMode(db, null);
+      expect(getRootMode(db)).toBeNull();
+      setRootMode(db, "serve-app");
+      setRootMode(db, "redirect"); // the default is stored as absence
+      expect(getRootMode(db)).toBeNull();
+      expect(getSetting(db, "root_mode")).toBeUndefined();
+    } finally {
+      db.close();
+    }
+  });
+
+  test("resolves to the redirect default when neither DB nor env is set", () => {
+    const db = openHubDb(hubDbPath(dir));
+    try {
+      expect(resolveRootMode(db, { env: noEnv })).toBe(DEFAULT_ROOT_MODE);
+      expect(resolveRootModeDetailed(db, { env: noEnv })).toEqual({
+        value: "redirect",
+        source: "default",
+      });
+    } finally {
+      db.close();
+    }
+  });
+
+  test("env override applies when no DB row; DB overrides env (DB is tier-1)", () => {
+    const db = openHubDb(hubDbPath(dir));
+    try {
+      const env = { [PARACHUTE_HUB_ROOT_MODE_ENV]: "serve-app" };
+      expect(resolveRootModeDetailed(db, { env })).toEqual({ value: "serve-app", source: "env" });
+      setRootMode(db, "serve-app");
+      // A DB "serve-app" over an env "redirect" resolves to db.
+      expect(
+        resolveRootModeDetailed(db, { env: { [PARACHUTE_HUB_ROOT_MODE_ENV]: "redirect" } }),
+      ).toEqual({ value: "serve-app", source: "db" });
+    } finally {
+      db.close();
+    }
+  });
+
+  test("an invalid DB row / env value is ignored → falls back to the redirect default", () => {
+    const db = openHubDb(hubDbPath(dir));
+    try {
+      setSetting(db, "root_mode", "bogus"); // hand-edited row bypassing write validation
+      expect(resolveRootMode(db, { env: noEnv, warn: silent })).toBe("redirect");
+      expect(getRootMode(db)).toBeNull(); // getRootMode also guards the invalid value
+      const env = { [PARACHUTE_HUB_ROOT_MODE_ENV]: "nonsense" };
+      expect(resolveRootModeDetailed(db, { env, warn: silent })).toEqual({
+        value: "redirect",
+        source: "default",
+      });
+    } finally {
+      db.close();
+    }
+  });
+
+  test("a null db (no state) resolves from env / default only", () => {
+    expect(resolveRootMode(null, { env: noEnv })).toBe("redirect");
+    expect(resolveRootMode(null, { env: { [PARACHUTE_HUB_ROOT_MODE_ENV]: "serve-app" } })).toBe(
+      "serve-app",
+    );
+  });
+});

package/src/__tests__/hub.test.ts

@@ -239,6 +239,35 @@ describe("renderHub — signed-out slimming (operator feedback)", () => {
   });
 });
 
+describe("renderHub — Get started tiles are uis[]-driven (W2-12)", () => {
+  // The tile logic runs client-side inside the discovery IIFE; these pins
+  // assert the emitted script's SHAPE (the JS-parses check above guards its
+  // validity). The section is uis[]-driven — one tile per active uis[]
+  // sub-unit, whichever mount identity (/surface/notes or
+  // /surface/parachute) an install serves — with the pre-W2-12 hardcoded
+  // "Open Notes" tile demoted to a fallback for surface-host rows that
+  // predate uis{} self-registration.
+  const html = renderHub({
+    session: { displayName: "operator", csrfToken: "csrf-w212" },
+  });
+
+  test("the discovery script iterates uis[] sub-units", () => {
+    expect(html).toContain("svc.uis");
+    // Inactive sub-units are skipped; absent status counts as active.
+    expect(html).toContain("ui.status");
+  });
+
+  test("the legacy 'Open Notes' hardcode survives only as the no-uis fallback", () => {
+    // Still present (pre-uis surface-host installs keep their CTA) …
+    expect(html).toContain("Open Notes");
+    expect(html).toContain("'/surface/notes/'");
+    // … but no longer keyed on the bare presence of parachute-surface as
+    // the PRIMARY path: the uis[] loop renders first, the hasSurface check
+    // only backstops an empty tile list.
+    expect(html).toContain("Legacy fallback");
+  });
+});
+
 describe("renderHub — signed-in indicator (rc.13)", () => {
   test("session user → 'Signed in as <name>' + inline POST form with CSRF", () => {
     const html = renderHub({

package/src/__tests__/install.test.ts

@@ -5,8 +5,11 @@ import { join } from "node:path";
 import { defaultStartLifecycleOpts, install } from "../commands/install.ts";
 import { hubDbPath, openHubDb } from "../hub-db.ts";
 import {
+  PARACHUTE_HUB_ROOT_MODE_ENV,
   PARACHUTE_HUB_ROOT_REDIRECT_ENV,
+  getRootMode,
   getRootRedirect,
+  setRootMode,
   setRootRedirect,
 } from "../hub-settings.ts";
 import { findService, upsertService } from "../services-manifest.ts";
@@ -68,6 +71,71 @@ describe("install", () => {
     }
   });
 
+  test("refuses `install agent` without invoking bun or the deprecated binary", async () => {
+    const { path, cleanup } = makeTempPath();
+    try {
+      const calls: string[][] = [];
+      const logs: string[] = [];
+      const code = await install("agent", {
+        runner: async (cmd) => {
+          calls.push([...cmd]);
+          return 0;
+        },
+        manifestPath: path,
+        startService: async () => 0,
+        isLinked: () => false,
+        portProbe: async () => false,
+        log: (line) => logs.push(line),
+      });
+      expect(code).toBe(1);
+      expect(calls).toEqual([]);
+      expect(logs.join("\n")).toMatch(/parachute-agent was retired/);
+      expect(logs.join("\n")).toMatch(/Vault and Surface/);
+    } finally {
+      cleanup();
+    }
+  });
+
+  test("refuses explicit retired Agent npm package names before invoking bun", async () => {
+    for (const packageName of [
+      "@openparachute/agent",
+      "@openparachute/agent@0.9.0",
+      "@openparachute/channel",
+    ]) {
+      const calls: string[][] = [];
+      const logs: string[] = [];
+      const code = await install(packageName, {
+        runner: async (cmd) => {
+          calls.push([...cmd]);
+          return 0;
+        },
+        log: (line) => logs.push(line),
+      });
+      expect(code).toBe(1);
+      expect(calls).toEqual([]);
+      expect(logs.join("\n")).toMatch(/parachute-agent was retired/);
+    }
+  });
+
+  test("refuses a local checkout whose package metadata is a retired Agent package", async () => {
+    const pkgDir = mkdtempSync(join(tmpdir(), "pcli-retired-agent-"));
+    try {
+      const calls: string[][] = [];
+      const code = await install(pkgDir, {
+        runner: async (cmd) => {
+          calls.push([...cmd]);
+          return 0;
+        },
+        readPackageName: () => "@openparachute/agent",
+        log: () => {},
+      });
+      expect(code).toBe(1);
+      expect(calls).toEqual([]);
+    } finally {
+      rmSync(pkgDir, { recursive: true, force: true });
+    }
+  });
+
   test("runs bun add -g then init; seeds manifest when service didn't write one", async () => {
     const { path, cleanup } = makeTempPath();
     try {
@@ -1642,10 +1710,10 @@ describe("install", () => {
         log: (l) => logs.push(l),
       });
       expect(code).toBe(0);
-      // First reservation slot is now 1945 — 1944 is parachute-app's
-      // canonical (assigned, non-walkable) slot as of hub-parity P5.
+      // Agent retirement released 1941, so it is now the first unassigned
+      // canonical slot available to the fallback walker.
       const entry = findService("parachute-vault", path);
-      expect(entry?.port).toBe(1945);
+      expect(entry?.port).toBe(1941);
       expect(logs.join("\n")).toMatch(/canonical port 1940 is in use/);
       // .env is not touched.
       const envPath = join(configDir, "vault", ".env");
@@ -1872,6 +1940,33 @@ describe("install", () => {
     }
   });
 
+  test("refuses third-party metadata that declares a retired Agent manifest identity", async () => {
+    const { path, cleanup } = makeTempPath();
+    try {
+      const logs: string[] = [];
+      const code = await install("@vendor/agent-wrapper", {
+        runner: async () => 0,
+        manifestPath: path,
+        isLinked: () => false,
+        log: (line) => logs.push(line),
+        readManifest: async () => ({
+          name: "claw",
+          manifestName: "@vendor/agent-wrapper",
+          port: 1952,
+          paths: ["/claw"],
+          health: "/claw/health",
+        }),
+        findGlobalInstall: () =>
+          "/fake/bun-globals/node_modules/@vendor/agent-wrapper/package.json",
+      });
+      expect(code).toBe(1);
+      expect(findService("claw", path)).toBeUndefined();
+      expect(logs.join("\n")).toMatch(/parachute-agent was retired/);
+    } finally {
+      cleanup();
+    }
+  });
+
   test("npm-installed third-party module persists installDir from bun globals", async () => {
     // hub#83: for `parachute install <npm-pkg>`, installDir is dirname of
     // the package.json that findGlobalInstall returns. Without this,
@@ -2325,31 +2420,38 @@ describe("hub#573 — install auto-start converges on supervised detection", ()
   });
 });
 
-// hub-parity P5 (2026-07-11): `parachute install app` defaults the hub's
-// bare `/` redirect to the app's front door — SET-IF-UNSET ONLY. Every test
-// here injects `rootRedirectDb` (a hub.db opened in the same disposable
-// tempdir `makeTempPath()` already isolates) so no real
-// `~/.parachute/hub.db` is ever touched — never drive this against the
+// `parachute install app` defaults the hub's origin root to SERVE the app
+// (root_mode = serve-app) on first install — SET-IF-UNSET ONLY, and only when
+// the root behavior is entirely pristine default (no mode row/env AND no
+// redirect row/env). Supersedes the prior hub-parity P5 behavior (which wrote
+// root_redirect = /app/). Every test here injects `rootRedirectDb` (a hub.db
+// opened in the same disposable tempdir `makeTempPath()` already isolates) so no
+// real `~/.parachute/hub.db` is ever touched — never drive this against the
 // operator's live install.
-describe("app-only root-redirect set-if-unset (hub-parity P5)", () => {
-  // The write gates on `resolveRootRedirectDetailed(db).source === "default"`,
-  // which consults `PARACHUTE_HUB_ROOT_REDIRECT`. Neutralize any ambient value
-  // (Aaron's box, CI) so the default-tier tests are deterministic; the
-  // env-set test below manages its own value inside its own body.
-  let savedEnv: string | undefined;
+describe("app-only serve-app set-if-unset default", () => {
+  // The write gates on the RESOLVED mode + redirect being `default` (no DB row,
+  // no env). Neutralize any ambient PARACHUTE_HUB_ROOT_MODE / _REDIRECT (Aaron's
+  // box, CI) so the default-tier tests are deterministic; the env-set tests
+  // below manage their own values inside their own bodies.
+  let savedRedirectEnv: string | undefined;
+  let savedModeEnv: string | undefined;
   beforeEach(() => {
-    savedEnv = process.env[PARACHUTE_HUB_ROOT_REDIRECT_ENV];
+    savedRedirectEnv = process.env[PARACHUTE_HUB_ROOT_REDIRECT_ENV];
+    savedModeEnv = process.env[PARACHUTE_HUB_ROOT_MODE_ENV];
     delete process.env[PARACHUTE_HUB_ROOT_REDIRECT_ENV];
+    delete process.env[PARACHUTE_HUB_ROOT_MODE_ENV];
   });
   afterEach(() => {
-    if (savedEnv === undefined) {
-      delete process.env[PARACHUTE_HUB_ROOT_REDIRECT_ENV];
-    } else {
-      process.env[PARACHUTE_HUB_ROOT_REDIRECT_ENV] = savedEnv;
+    for (const [name, saved] of [
+      [PARACHUTE_HUB_ROOT_REDIRECT_ENV, savedRedirectEnv],
+      [PARACHUTE_HUB_ROOT_MODE_ENV, savedModeEnv],
+    ] as const) {
+      if (saved === undefined) delete process.env[name];
+      else process.env[name] = saved;
     }
   });
 
-  test("fresh install (no prior root_redirect) sets it to /app/", async () => {
+  test("fresh install (pristine root) flips root_mode to serve-app", async () => {
     const { path, configDir, cleanup } = makeTempPath();
     try {
       const db = openHubDb(hubDbPath(configDir));
@@ -2366,8 +2468,10 @@ describe("app-only root-redirect set-if-unset (hub-parity P5)", () => {
           log: (l) => logs.push(l),
         });
         expect(code).toBe(0);
-        expect(getRootRedirect(db)).toBe("/app/");
-        expect(logs.join("\n")).toMatch(/front page.*now opens the app at \/app\//);
+        expect(getRootMode(db)).toBe("serve-app");
+        // The redirect row is NOT written — serve-app takes over `/` directly.
+        expect(getRootRedirect(db)).toBeNull();
+        expect(logs.join("\n")).toMatch(/front page.*now serves the Parachute app/);
       } finally {
         db.close();
       }
@@ -2376,7 +2480,7 @@ describe("app-only root-redirect set-if-unset (hub-parity P5)", () => {
     }
   });
 
-  test("a pre-set root_redirect is left alone — never clobbered", async () => {
+  test("a pre-set root_redirect is left alone — mode NOT flipped", async () => {
     const { path, configDir, cleanup } = makeTempPath();
     try {
       const db = openHubDb(hubDbPath(configDir));
@@ -2394,13 +2498,10 @@ describe("app-only root-redirect set-if-unset (hub-parity P5)", () => {
           log: (l) => logs.push(l),
         });
         expect(code).toBe(0);
-        // The operator's prior choice survives byte-for-byte.
+        // The operator's prior choice survives byte-for-byte; no mode flip.
         expect(getRootRedirect(db)).toBe("/surface/reading-room");
-        // The set-if-unset write's OWN log line (distinct from the static
-        // postInstallFooter boilerplate, which always prints "now opens the
-        // app too, unless you've already..." regardless of whether the write
-        // fired) must NOT appear — the write itself was skipped.
-        expect(logs.join("\n")).not.toMatch(/now opens the app at \/app\//);
+        expect(getRootMode(db)).toBeNull();
+        expect(logs.join("\n")).not.toMatch(/now serves the Parachute app/);
       } finally {
         db.close();
       }
@@ -2409,7 +2510,40 @@ describe("app-only root-redirect set-if-unset (hub-parity P5)", () => {
     }
   });
 
-  test("installing a different module never touches root_redirect", async () => {
+  test("an existing install with the old /app/ redirect keeps redirecting (back-compat)", async () => {
+    // A hub that ran the PRIOR app-install code has root_redirect = /app/ in its
+    // DB (source = db → not default). Re-running `install app` must NOT flip it
+    // to serve-app — it keeps 302-ing to /app/, exactly as before. This is the
+    // "existing installs unchanged" guarantee.
+    const { path, configDir, cleanup } = makeTempPath();
+    try {
+      const db = openHubDb(hubDbPath(configDir));
+      const logs: string[] = [];
+      try {
+        setRootRedirect(db, "/app/");
+        const code = await install("app", {
+          runner: async () => 0,
+          manifestPath: path,
+          configDir,
+          startService: async () => 0,
+          isLinked: () => false,
+          portProbe: async () => false,
+          rootRedirectDb: db,
+          log: (l) => logs.push(l),
+        });
+        expect(code).toBe(0);
+        expect(getRootMode(db)).toBeNull();
+        expect(getRootRedirect(db)).toBe("/app/");
+        expect(logs.join("\n")).not.toMatch(/now serves the Parachute app/);
+      } finally {
+        db.close();
+      }
+    } finally {
+      cleanup();
+    }
+  });
+
+  test("installing a different module never touches the root settings", async () => {
     const { path, configDir, cleanup } = makeTempPath();
     try {
       const db = openHubDb(hubDbPath(configDir));
@@ -2426,6 +2560,7 @@ describe("app-only root-redirect set-if-unset (hub-parity P5)", () => {
         });
         expect(code).toBe(0);
         expect(getRootRedirect(db)).toBeNull();
+        expect(getRootMode(db)).toBeNull();
       } finally {
         db.close();
       }
@@ -2434,13 +2569,12 @@ describe("app-only root-redirect set-if-unset (hub-parity P5)", () => {
     }
   });
 
-  test("an ENV-configured redirect (no DB row) is left alone — never clobbered (N1)", async () => {
+  test("an ENV-configured redirect (no DB row) is left alone — no mode flip (N1)", async () => {
     // Container deploys pin the landing page via PARACHUTE_HUB_ROOT_REDIRECT,
-    // not a DB row. Gating on `getRootRedirect(db) === null` (DB only) would
-    // miss this and write `/app/`, which — since the DB row wins over env on
-    // read — silently overrides their configured landing. The fix gates on
-    // `resolveRootRedirectDetailed(db).source === "default"`, which sees the
-    // env tier. So: env set → no DB row written.
+    // not a DB row. Flipping to serve-app would silently override their
+    // configured landing (serve-app wins over redirect at `/`). The gate reads
+    // the RESOLVED redirect source; with the env set that's `env`, not
+    // `default`, so we leave it alone.
     const { path, configDir, cleanup } = makeTempPath();
     const prevEnv = process.env[PARACHUTE_HUB_ROOT_REDIRECT_ENV];
     try {
@@ -2459,9 +2593,10 @@ describe("app-only root-redirect set-if-unset (hub-parity P5)", () => {
           log: (l) => logs.push(l),
         });
         expect(code).toBe(0);
-        // No DB row written — the env-configured landing survives.
+        // No mode row written — the env-configured landing survives.
+        expect(getRootMode(db)).toBeNull();
         expect(getRootRedirect(db)).toBeNull();
-        expect(logs.join("\n")).not.toMatch(/now opens the app at \/app\//);
+        expect(logs.join("\n")).not.toMatch(/now serves the Parachute app/);
       } finally {
         db.close();
       }
@@ -2475,6 +2610,43 @@ describe("app-only root-redirect set-if-unset (hub-parity P5)", () => {
     }
   });
 
+  test("an ENV-configured mode (no DB row) is left alone — no clobber", async () => {
+    // PARACHUTE_HUB_ROOT_MODE=redirect on a container that deliberately wants
+    // the redirect front door. The gate sees the resolved mode source as `env`,
+    // not `default`, so it does NOT write a serve-app row.
+    const { path, configDir, cleanup } = makeTempPath();
+    const prevEnv = process.env[PARACHUTE_HUB_ROOT_MODE_ENV];
+    try {
+      process.env[PARACHUTE_HUB_ROOT_MODE_ENV] = "redirect";
+      const db = openHubDb(hubDbPath(configDir));
+      const logs: string[] = [];
+      try {
+        const code = await install("app", {
+          runner: async () => 0,
+          manifestPath: path,
+          configDir,
+          startService: async () => 0,
+          isLinked: () => false,
+          portProbe: async () => false,
+          rootRedirectDb: db,
+          log: (l) => logs.push(l),
+        });
+        expect(code).toBe(0);
+        expect(getRootMode(db)).toBeNull();
+        expect(logs.join("\n")).not.toMatch(/now serves the Parachute app/);
+      } finally {
+        db.close();
+      }
+    } finally {
+      if (prevEnv === undefined) {
+        delete process.env[PARACHUTE_HUB_ROOT_MODE_ENV];
+      } else {
+        process.env[PARACHUTE_HUB_ROOT_MODE_ENV] = prevEnv;
+      }
+      cleanup();
+    }
+  });
+
   test("production gate: without rootRedirectDb + a tempdir manifestPath, the write is skipped (not attempted)", async () => {
     // Mirrors the existing `guidanceProbeAllowed` discriminant elsewhere in
     // install.ts: a test with a tempdir manifestPath and no explicit opt-in

package/src/__tests__/migrate.test.ts

@@ -56,7 +56,9 @@ describe("safelistEntries", () => {
     expect(s.has("vault")).toBe(true);
     expect(s.has("notes")).toBe(true);
     expect(s.has("scribe")).toBe(true);
-    expect(s.has("agent")).toBe(true);
+    expect(s.has("agent")).toBe(false);
+    expect(KNOWN_ARCHIVABLE_DIRS.has("agent")).toBe(true);
+    expect(KNOWN_ARCHIVABLE_DIRS.has("channel")).toBe(true);
     // Internal
     expect(s.has("hub")).toBe(true);
     // CLI state

package/src/__tests__/oauth-handlers.test.ts

@@ -3,6 +3,11 @@ import { createHash, randomBytes } from "node:crypto";
 import { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
+import {
+  checkAuthorizationServerMetadata,
+  checkProtectedResourceMetadata,
+  checkTokenResponseInvariants,
+} from "@openparachute/door-contract";
 import { handleAdminLoginPost, handleAdminLoginTotpPost } from "../admin-handlers.ts";
 import { approveClient, getClient, registerClient } from "../clients.ts";
 import { CSRF_COOKIE_NAME } from "../csrf.ts";
@@ -122,9 +127,12 @@ describe("authorizationServerMetadata", () => {
     // hub:admin + scribe:admin are operator-only (non-requestable) — never advertised (2026-06-30)
     expect(scopesSupported).not.toContain("hub:admin");
     expect(scopesSupported).not.toContain("scribe:admin");
-    // agent isn't in the fixture manifest → its scopes aren't advertised
-    // (hub#…: optional-module scopes only surface when the module is installed).
+    // Retired Agent scopes are no longer part of the first-party catalog.
     expect(scopesSupported).not.toContain("agent:send");
+    // H1.2 — door-contract conformance: the static RFC 8414 fields (endpoints,
+    // response/grant types, PKCE method, token-auth methods) match the shared
+    // contract exactly (V1.4/C1.4 twin coverage, hub half).
+    expect(checkAuthorizationServerMetadata(body, ISSUER, scopesSupported)).toEqual([]);
   });
 
   test("does NOT advertise non-requestable operator-only scopes", async () => {
@@ -164,7 +172,7 @@ describe("authorizationServerMetadata", () => {
     const body = (await res.json()) as Record<string, unknown>;
     const scopesSupported = body.scopes_supported as string[];
     // Third-party scopes show up (`widget:*` / `mymodule:*` aren't gated
-    // optional-module prefixes — only scribe:/agent: are, see OPTIONAL_MODULE_SCOPES).
+    // optional-module prefixes — only scribe:/surface: are, see OPTIONAL_MODULE_SCOPES).
     expect(scopesSupported).toContain("widget:read");
     expect(scopesSupported).toContain("widget:write");
     expect(scopesSupported).toContain("mymodule:do-thing");
@@ -178,10 +186,10 @@ describe("authorizationServerMetadata", () => {
   });
 
   test("advertises an optional module's scopes only when it's installed", async () => {
-    // FIRST_PARTY_SCOPES carries scribe:* + agent:send statically. On a
+    // FIRST_PARTY_SCOPES carries scribe:* statically. On a
     // vault-only hub they must NOT be advertised — a discovery client (e.g.
     // claude.ai's connector UI) lists the catalog verbatim, so a friend
-    // connecting one vault was shown Scribe + Agent access the hub can't
+    // connecting one vault was shown Scribe access the hub can't
     // honor. Vault + hub are core and always advertised.
     const declared = new Set<string>([
       "vault:read",
@@ -189,7 +197,6 @@ describe("authorizationServerMetadata", () => {
       "vault:admin",
       "scribe:transcribe",
       "scribe:admin",
-      "agent:send",
       "hub:admin",
     ]);
     const vaultOnly = {
@@ -217,7 +224,6 @@ describe("authorizationServerMetadata", () => {
     // uninstalled optional-module scopes are dropped
     expect(scopes).not.toContain("scribe:transcribe");
     expect(scopes).not.toContain("scribe:admin");
-    expect(scopes).not.toContain("agent:send");
 
     // ...but once scribe is installed, its scopes ARE advertised again.
     const withScribe = {
@@ -249,7 +255,6 @@ describe("authorizationServerMetadata", () => {
     // requestability gate (non-requestable, 2026-06-30) doing the work here, not
     // the optional-module-not-installed gate that drops scribe:transcribe above.
     expect(scopes2).not.toContain("scribe:admin");
-    expect(scopes2).not.toContain("agent:send"); // agent still not installed
   });
 });
 
@@ -265,6 +270,8 @@ describe("protectedResourceMetadata (RFC 9728, closes hub#393)", () => {
     expect(body.resource).toBe(ISSUER);
     expect(body.authorization_servers).toEqual([ISSUER]);
     expect(body.bearer_methods_supported).toEqual(["header"]);
+    // H1.2 — door-contract conformance (V1.4/C1.4 twin coverage, hub half).
+    expect(checkProtectedResourceMetadata(body, ISSUER)).toEqual([]);
     expect(Array.isArray(body.scopes_supported)).toBe(true);
     expect(body.resource_documentation).toMatch(/parachute\.computer/);
   });
@@ -2320,6 +2327,10 @@ describe("handleToken — full OAuth dance", () => {
       expect(tokenBody.token_type).toBe("Bearer");
       expect(tokenBody.scope).toBe("vault:default:read");
       expect(tokenBody.refresh_token.length).toBeGreaterThan(20);
+      // H1.2 — door-contract conformance: token_type/expires_in/scope/access_token
+      // invariants against a REAL `POST /oauth/token` success body (V1.4/C1.4 twin
+      // coverage, hub half).
+      expect(checkTokenResponseInvariants(tokenBody, "vault:default:read")).toEqual([]);
 
       // JWT must verify against the hub's signing keys, with the right sub +
       // aud (named `vault:default:read` → "vault.default" — RFC 8707-style