@openparachute/hub 0.7.7-rc.9 → 0.7.7

package/src/__tests__/setup-wizard.test.ts

@@ -219,6 +219,80 @@ describe("deriveWizardState", () => {
     }
   });
 
+  test("real-version vault row with paths:[] is NOT a real vault (e2e boot-spawned-child fix)", async () => {
+    // The Tier-1 e2e wizard-skip root cause. When the hub boot-spawns the vault
+    // MODULE child, vault's selfRegister writes its services.json row at the
+    // REAL package version (e.g. 0.7.4-rc.1, NOT SEED_VERSION) but with
+    // `paths: []` because no vault instance exists yet. The SEED_VERSION
+    // sentinel alone did NOT catch this — a bare `version !== SEED_VERSION`
+    // check read the empty-paths row as a real vault, so the wizard skipped its
+    // vault step and `--vault-name` was ignored. hasRealVault must be
+    // INSTANCE-aware: no mount path → not a real vault (the #478 empty-paths
+    // discrimination findExistingVault already uses).
+    const db = openHubDb(hubDbPath(h.dir));
+    try {
+      await createUser(db, "owner", "pw");
+      writeManifest(
+        {
+          services: [
+            {
+              name: "parachute-vault",
+              version: "0.7.4-rc.1",
+              port: 1940,
+              paths: [],
+              health: "/health",
+            },
+          ],
+        },
+        h.manifestPath,
+      );
+      const s = deriveWizardState({
+        db,
+        manifestPath: h.manifestPath,
+        readExposeStateFn: h.readExposeStateFn,
+      });
+      expect(s.hasRealVault).toBe(false);
+      expect(s.hasVault).toBe(false);
+      expect(s.step).toBe("vault");
+    } finally {
+      db.close();
+    }
+  });
+
+  test("real-version vault row WITH a mount path IS a real vault (positive control)", async () => {
+    // The counterpart to the empty-paths case: a genuinely-created vault carries
+    // a `/vault/<name>` path at a real version, so hasRealVault must be true and
+    // the wizard advances past the vault step.
+    const db = openHubDb(hubDbPath(h.dir));
+    try {
+      await createUser(db, "owner", "pw");
+      writeManifest(
+        {
+          services: [
+            {
+              name: "parachute-vault",
+              version: "0.7.4-rc.1",
+              port: 1940,
+              paths: ["/vault/e2e"],
+              health: "/health",
+            },
+          ],
+        },
+        h.manifestPath,
+      );
+      const s = deriveWizardState({
+        db,
+        manifestPath: h.manifestPath,
+        readExposeStateFn: h.readExposeStateFn,
+      });
+      expect(s.hasRealVault).toBe(true);
+      expect(s.hasVault).toBe(true);
+      expect(s.step).toBe("expose");
+    } finally {
+      db.close();
+    }
+  });
+
   test("expose step when admin + vault exist but expose mode not set yet (hub#268 Item 2)", async () => {
     const db = openHubDb(hubDbPath(h.dir));
     try {
@@ -1712,13 +1786,15 @@ describe("handleSetupVaultPost", () => {
     }
   });
 
-  test("idempotent — second POST while supervisor is running doesn't fire a second `bun add` (N2)", async () => {
+  test("second POST while supervisor is running but vault UNREGISTERED — synthesize success, no 2nd bun add, no double provision (N2 race)", async () => {
     // Reviewer-flagged race: two concurrent POSTs before either seeds
-    // services.json both pass `state.hasVault === false` and each fire
-    // `runInstall` → each fires `bun add -g`. The wizard mirrors the
-    // `handleInstall` guard pattern: if the supervisor already has a
-    // live (starting/running/restarting) state for vault, mark the new
-    // op succeeded synchronously and skip the second install.
+    // services.json both pass `state.hasVault === false`. The supervisor is
+    // already running vault (a prior POST's runInstall spawned it) but the
+    // services.json row hasn't been written yet — so `vaultAlreadyRegistered`
+    // is false. The wizard must NOT fire a second `bun add -g` AND must NOT
+    // fire `provisionVault` (which would `parachute install vault` a second
+    // time in this pre-seed window — reviewer N2). Instead it synthesizes a
+    // succeeded op and lets the in-flight install create the vault.
     const db = openHubDb(hubDbPath(h.dir));
     try {
       const user = await createUser(db, "owner", "pw");
@@ -1734,8 +1810,9 @@ describe("handleSetupVaultPost", () => {
       });
       const csrf = setCookie(get, CSRF_COOKIE_NAME) ?? "";
       // Real supervisor with the never-exits spawn stub from makeSupervisor.
-      // Pre-spawn vault so `supervisor.get("vault").status === "starting"`
-      // by the time the wizard's POST runs.
+      // Pre-spawn vault so `supervisor.get("vault").status === "starting"`.
+      // The harness manifest is EMPTY (vault not registered) — the pre-seed
+      // window.
       const supervisor = makeSupervisor();
       await supervisor.start({ short: "vault", cmd: ["bun", "noop"] });
       const runCalls: string[][] = [];
@@ -1743,6 +1820,17 @@ describe("handleSetupVaultPost", () => {
         runCalls.push([...cmd]);
         return 0;
       };
+      // provisionVault must NOT be called in the unregistered race window.
+      const provisionCalls: string[] = [];
+      const provisionVaultImpl = async (name: string) => {
+        provisionCalls.push(name);
+        return {
+          ok: true as const,
+          created: true,
+          entry: { name, url: `https://hub.example/vault/${name}`, version: "1.0.0" },
+          createJson: null,
+        };
+      };
       const post = await handleSetupVaultPost(
         req("/admin/setup/vault", {
           method: "POST",
@@ -1763,17 +1851,17 @@ describe("handleSetupVaultPost", () => {
           supervisor,
           registry: getDefaultOperationsRegistry(),
           run: stubbedRun,
+          provisionVaultImpl,
         },
       );
       expect(post.status).toBe(303);
       const location = post.headers.get("location") ?? "";
       expect(location).toMatch(/^\/admin\/setup\?op=/);
-      // Yield enough for any background runInstall promise to fire if
-      // the guard failed. Then assert: no `bun add` was invoked, and
-      // the op went straight to `succeeded` with the canonical
-      // "already supervised" log line.
+      // Yield for any background promise. Then assert: no `bun add`, NO
+      // provisionVault call (no double-install), op synthesized succeeded.
       await new Promise((r) => setTimeout(r, 50));
       expect(runCalls.length).toBe(0);
+      expect(provisionCalls).toEqual([]);
       const opId = new URL(location, "http://x").searchParams.get("op") ?? "";
       const op = getDefaultOperationsRegistry().get(opId);
       expect(op?.status).toBe("succeeded");
@@ -1783,6 +1871,200 @@ describe("handleSetupVaultPost", () => {
     }
   });
 
+  test("boot-spawned vault child (real version, paths:[]) — wizard create actually provisions the named vault (e2e wizard-skip fix)", async () => {
+    // The exact Tier-1 e2e bug. The hub boot-spawns the vault MODULE child so it
+    // can selfRegister; that child writes a services.json row at the REAL
+    // package version (NOT SEED_VERSION) with `paths: []` because no vault
+    // instance exists yet, AND the supervisor already reports vault "running".
+    // Pre-fix: hasRealVault read the real-version row as a real vault, the
+    // wizard skipped its vault step, and even if it POSTed, the already-
+    // supervised short-circuit synthesized a succeeded op that created NOTHING
+    // — `--vault-name e2e` was silently dropped. Post-fix: the empty-paths row
+    // reads as no-real-vault (hasRealVault=false), the POST is honored, and the
+    // short-circuit drives provisionVault to actually create the named vault.
+    const db = openHubDb(hubDbPath(h.dir));
+    try {
+      const user = await createUser(db, "owner", "pw");
+      const { createSession, SESSION_COOKIE_NAME: SC } = await import("../sessions.ts");
+      const session = createSession(db, { userId: user.id });
+      // Boot-spawned child's self-registered row: real version, paths: [].
+      writeManifest(
+        {
+          services: [
+            {
+              name: "parachute-vault",
+              version: "0.7.4-rc.1",
+              port: 1940,
+              paths: [],
+              health: "/health",
+            },
+          ],
+        },
+        h.manifestPath,
+      );
+      // deriveWizardState must NOT treat the empty-paths real-version row as a
+      // real vault (this is what un-skipped the wizard's vault step).
+      const derived = deriveWizardState({
+        db,
+        manifestPath: h.manifestPath,
+        readExposeStateFn: h.readExposeStateFn,
+      });
+      expect(derived.hasRealVault).toBe(false);
+      expect(derived.step).toBe("vault");
+
+      const get = handleSetupGet(req("/admin/setup"), {
+        db,
+        manifestPath: h.manifestPath,
+        configDir: h.dir,
+        readExposeStateFn: h.readExposeStateFn,
+        issuer: "https://hub.example",
+        registry: getDefaultOperationsRegistry(),
+      });
+      const csrf = setCookie(get, CSRF_COOKIE_NAME) ?? "";
+      // Supervisor already running the boot-spawned vault module child.
+      const supervisor = makeSupervisor();
+      await supervisor.start({ short: "vault", cmd: ["bun", "noop"] });
+      const runCalls: string[][] = [];
+      const provisionCalls: string[] = [];
+      const provisionVaultImpl = async (name: string) => {
+        provisionCalls.push(name);
+        return {
+          ok: true as const,
+          created: true,
+          entry: { name, url: `https://hub.example/vault/${name}`, version: "0.7.4-rc.1" },
+          createJson: null,
+        };
+      };
+      const post = await handleSetupVaultPost(
+        req("/admin/setup/vault", {
+          method: "POST",
+          body: new URLSearchParams({
+            [CSRF_FIELD_NAME]: csrf,
+            mode: "create",
+            vault_name: "e2e",
+          }).toString(),
+          headers: {
+            "content-type": "application/x-www-form-urlencoded",
+            cookie: `${CSRF_COOKIE_NAME}=${csrf}; ${SC}=${session.id}`,
+          },
+        }),
+        {
+          db,
+          manifestPath: h.manifestPath,
+          configDir: h.dir,
+          readExposeStateFn: h.readExposeStateFn,
+          issuer: "https://hub.example",
+          supervisor,
+          registry: getDefaultOperationsRegistry(),
+          run: async (cmd) => {
+            runCalls.push([...cmd]);
+            return 0;
+          },
+          provisionVaultImpl,
+        },
+      );
+      expect(post.status).toBe(303);
+      const location = post.headers.get("location") ?? "";
+      expect(location).toMatch(/^\/admin\/setup\?op=/);
+      await new Promise((r) => setTimeout(r, 50));
+      // The named vault WAS provisioned (not silently dropped) …
+      expect(provisionCalls).toEqual(["e2e"]);
+      // … and no `bun add -g` fired (module already supervised).
+      expect(runCalls.some((c) => c.join(" ").includes("bun add -g"))).toBe(false);
+      const opId = new URL(location, "http://x").searchParams.get("op") ?? "";
+      const op = getDefaultOperationsRegistry().get(opId);
+      expect(op?.status).toBe("succeeded");
+      expect(op?.log.join("\n")).toContain('vault "e2e" created');
+    } finally {
+      db.close();
+    }
+  });
+
+  test("import mode on an already-supervised box is REJECTED (no empty vault + fake success) — review must-fix", async () => {
+    // On a boot-spawned box (vault module already supervised), the short-circuit
+    // create path provisions an EMPTY vault. An IMPORT request must NOT be run
+    // through it: that would leave an empty vault named after the import target
+    // + a false "vault created" banner (a data-integrity footgun). The wizard
+    // rejects import with an actionable message + a FAILED op instead.
+    const db = openHubDb(hubDbPath(h.dir));
+    try {
+      const user = await createUser(db, "owner", "pw");
+      const { createSession, SESSION_COOKIE_NAME: SC } = await import("../sessions.ts");
+      const session = createSession(db, { userId: user.id });
+      writeManifest(
+        {
+          services: [
+            {
+              name: "parachute-vault",
+              version: "0.7.4-rc.1",
+              port: 1940,
+              paths: [],
+              health: "/health",
+            },
+          ],
+        },
+        h.manifestPath,
+      );
+      const get = handleSetupGet(req("/admin/setup"), {
+        db,
+        manifestPath: h.manifestPath,
+        configDir: h.dir,
+        readExposeStateFn: h.readExposeStateFn,
+        issuer: "https://hub.example",
+        registry: getDefaultOperationsRegistry(),
+      });
+      const csrf = setCookie(get, CSRF_COOKIE_NAME) ?? "";
+      const supervisor = makeSupervisor();
+      await supervisor.start({ short: "vault", cmd: ["bun", "noop"] });
+      const provisionCalls: string[] = [];
+      const post = await handleSetupVaultPost(
+        req("/admin/setup/vault", {
+          method: "POST",
+          headers: {
+            accept: "application/json",
+            "content-type": "application/json",
+            cookie: `${CSRF_COOKIE_NAME}=${csrf}; ${SC}=${session.id}`,
+          },
+          body: JSON.stringify({
+            [CSRF_FIELD_NAME]: csrf,
+            mode: "import",
+            vault_name: "fromgit",
+            remote_url: "https://example.com/repo.git",
+            import_mode: "merge",
+          }),
+        }),
+        {
+          db,
+          manifestPath: h.manifestPath,
+          configDir: h.dir,
+          readExposeStateFn: h.readExposeStateFn,
+          issuer: "https://hub.example",
+          supervisor,
+          registry: getDefaultOperationsRegistry(),
+          provisionVaultImpl: async (name: string) => {
+            provisionCalls.push(name);
+            return {
+              ok: true as const,
+              created: true,
+              entry: { name, url: `https://hub.example/vault/${name}`, version: "0.7.4-rc.1" },
+              createJson: null,
+            };
+          },
+        },
+      );
+      expect(post.status).toBe(200);
+      const body = (await post.json()) as { op_id?: string; message?: string };
+      expect(body.message ?? "").toContain("isn't supported");
+      // Import was NOT provisioned (no empty vault created).
+      expect(provisionCalls).toEqual([]);
+      // The op is FAILED, not a fake success.
+      const op = body.op_id ? getDefaultOperationsRegistry().get(body.op_id) : undefined;
+      expect(op?.status).toBe("failed");
+    } finally {
+      db.close();
+    }
+  });
+
   test("create on a SEED-placeholder box: does NOT short-circuit + drives the supervisor to start vault (hub#607 + hub#608)", async () => {
     // hub#607 + hub#608 coupled fresh-operator flow. On an init'd box,
     // services.json already carries a `parachute-vault` placeholder at
@@ -2066,19 +2348,16 @@ describe("handleSetupVaultPost", () => {
   test("scribe transcribe=local resolves to the host platform's backend (the Linux trap fix)", async () => {
     // The bug: `local` mapped UNCONDITIONALLY to parakeet-mlx (macOS-only),
     // silently broken on every Linux box. After the fix it resolves to the
-    // platform backend. We assert against the actual host so it's correct on
-    // both Mac (parakeet-mlx) and Linux CI (onnx-asr). The RAM gate only kicks
-    // in below 2 GB — CI/dev boxes clear it, so the choice stays `local`.
-    const { platformLocalProvider } = await import("../scribe-config.ts");
-    const expected = platformLocalProvider(process.platform);
+    // platform backend. The expectation uses the same host RAM decision so
+    // constrained CI boxes correctly assert the cloud fallback instead.
+    const { decideLocalProvider, readAvailableRamMib } = await import("../scribe-config.ts");
+    const decision = decideLocalProvider(process.platform, readAvailableRamMib());
     const { response } = await postVaultWithFields(h, { scribe_provider: "local" });
     expect(response.status).toBe(303);
     const cfg = readScribeConfig(h.dir);
-    if (expected !== null) {
-      // On a supported platform with enough RAM, `local` resolves to the
-      // platform backend — NOT a hardcoded parakeet-mlx on Linux.
-      expect(cfg?.transcribe).toEqual({ provider: expected });
-    }
+    expect(cfg?.transcribe).toEqual({
+      provider: decision.ok ? decision.provider : decision.steerTo,
+    });
   });
 });
 

package/src/__tests__/setup.test.ts

@@ -185,18 +185,14 @@ describe("setup", () => {
     }
   });
 
-  test("fresh box: the offered 'Available to install' list excludes deprecated notes + removed runner", async () => {
+  test("fresh box: the offered list excludes deprecated notes and removed Agent/runner", async () => {
     const h = makeHarness();
     try {
-      // 'all' picks every OFFERED service. With a clean services.json the survey
-      // sees every known short; the offered filter must drop notes (deprecated,
-      // 2026-06-25) while runner never even reaches the survey (registry
-      // removal, 2026-07-01) — keeping vault/scribe/surface/agent. Only vault +
-      // scribe have pre-install follow-up prompts (vault name, scribe provider);
-      // surface + agent have none — so the scripted answers below are complete.
+      // 'all' picks every offered service. The clean-box offer excludes notes
+      // (deprecated) and retired Agent/runner, keeping vault/scribe/surface/app.
       const availability = scriptedAvailability([
-        "all", // pick everything offered
-        "default", // vault name (vault is in the offered set)
+        "all",
+        "default", // vault name
         "1", // scribe provider
       ]);
       const code = await setup({
@@ -210,20 +206,19 @@ describe("setup", () => {
         },
       });
       expect(code).toBe(0);
-      // The "Available to install" banner must NOT list notes / runner.
       const joined = h.logs.join("\n");
       const availableBlock = joined.slice(joined.indexOf("Available to install:"));
       expect(availableBlock).not.toMatch(/\bnotes\b/);
       expect(availableBlock).not.toMatch(/\brunner\b/);
-      // …and `install()` is never invoked for the deprecated shorts.
+      expect(availableBlock).not.toMatch(/\bagent\b/);
       const installedShorts = h.calls.map((c) => c.short);
       expect(installedShorts).not.toContain("notes");
       expect(installedShorts).not.toContain("runner");
-      // The non-deprecated set is still offered + installed.
+      expect(installedShorts).not.toContain("agent");
       expect(installedShorts).toContain("vault");
       expect(installedShorts).toContain("scribe");
       expect(installedShorts).toContain("surface");
-      expect(installedShorts).toContain("agent");
+      expect(installedShorts).toContain("app");
     } finally {
       h.cleanup();
     }

package/src/__tests__/status.test.ts

@@ -225,11 +225,6 @@ describe("status — per-module URL deep-links (manifestRowBase / urlForEntry)",
     expect(out).toMatch(/:5173\/notes/);
   });
 
-  test("channel row prints port + /channel mount", async () => {
-    const out = await urlFor("parachute-channel", 1943, ["/channel"]);
-    expect(out).toMatch(/:1943\/channel/);
-  });
-
   test("unknown third-party service falls back to bare host:port + paths[0]", async () => {
     const { path, configDir, cleanup } = makeTempPath();
     try {