@openparachute/vault 0.6.3-rc.5 → 0.6.4-rc.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openparachute/vault",
-  "version": "0.6.3-rc.5",
+  "version": "0.6.4-rc.1",
   "description": "Agent-native knowledge graph. Notes, tags, links over MCP.",
   "module": "src/cli.ts",
   "type": "module",

package/src/admin-spa.test.ts

@@ -38,9 +38,22 @@ describe("isAdminSpaPath", () => {
     expect(isAdminSpaPath("/vault/work/admin/")).toBe(true);
     expect(isAdminSpaPath("/vault/work/admin/tokens")).toBe(true);
     expect(isAdminSpaPath("/vault/boulder/admin/assets/index.js")).toBe(true);
-    // Vault names with URL-safe punctuation should still match — the regex
-    // captures up to the next "/" so dashes / dots / digits all pass.
-    expect(isAdminSpaPath("/vault/my-vault.2/admin")).toBe(true);
+    // Canonical-charset names (lowercase alphanumerics + hyphen / underscore)
+    // match; dots are NOT canonical (see the vault#253 reject test below).
+    expect(isAdminSpaPath("/vault/my-vault_2/admin")).toBe(true);
+  });
+
+  test("vault#253: names outside the canonical charset do NOT match the mount", () => {
+    // The mount used to capture `[^/]+`, so a name hub can never manage
+    // (dots, @, unicode) still served the admin SPA. Aligning the mount to
+    // hub's VAULT_NAME_CHARSET_RE (`/^[a-z0-9_-]+$/`) makes a non-canonical
+    // name 404 — the same answer hub gives. No legitimately-created vault can
+    // carry these characters (cmdCreate / init / the env var all reject them
+    // via validateVaultName), so nothing reachable regresses.
+    expect(isAdminSpaPath("/vault/my.vault/admin")).toBe(false);
+    expect(isAdminSpaPath("/vault/vault@v2/admin")).toBe(false);
+    expect(isAdminSpaPath("/vault/Work/admin")).toBe(false); // uppercase isn't canonical
+    expect(isAdminSpaPath("/vault/🦑/admin")).toBe(false);
   });
 
   test("does not match adjacent paths under the same vault", () => {
@@ -111,8 +124,8 @@ describe("serveAdminSpa", () => {
     expect(cssRes.headers.get("content-type")).toContain("text/css");
   });
 
-  test("vault names with URL-safe punctuation strip cleanly", async () => {
-    const res = await serveAdminSpa(fixtureDir, "/vault/my-vault.2/admin/assets/index-abc.js");
+  test("canonical-charset vault names strip cleanly", async () => {
+    const res = await serveAdminSpa(fixtureDir, "/vault/my-vault_2/admin/assets/index-abc.js");
     expect(res.status).toBe(200);
     expect(res.headers.get("content-type")).toContain("application/javascript");
   });

package/src/admin-spa.ts

@@ -21,12 +21,33 @@ import { existsSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 
+/**
+ * The canonical vault-name charset, kept byte-identical with hub's
+ * `VAULT_NAME_CHARSET_RE` (`parachute-hub/src/vault-name.ts`) and vault's own
+ * `validateVaultName` (`src/vault-name.ts`): lowercase alphanumerics plus
+ * hyphen / underscore. Embedded here (not imported) because this regex is
+ * spliced into the mount-matching patterns below, and a charset class is the
+ * only piece they share.
+ *
+ * vault#253: the mount regexes used to capture `[^/]+` (anything-but-slash),
+ * so a name like `my.vault` / `vault@v2` / `🦑` matched the admin mount and
+ * served the SPA — even though hub rejects those names at every name-minting
+ * edge and can never render a "Manage Vault" link for them. A vault that can't
+ * be created (cmdCreate / init / the env var all run `validateVaultName`, which
+ * rejects out-of-charset names) shouldn't have a reachable admin mount either.
+ * Pinning the mount to THIS charset closes the boundary drift: a dotted name
+ * no longer matches → 404, the same answer hub gives.
+ */
+const VAULT_NAME_CHARSET = "a-z0-9_-";
+
 /**
  * Regex anchoring the per-vault SPA mount. Matches `/vault/<name>/admin`
- * exactly and any subpath under it. The `<name>` capture is reused by the
- * prefix-strip below — keep the two in sync if this regex moves.
+ * exactly and any subpath under it, where `<name>` is a canonical vault name
+ * (lowercase alphanumerics + hyphen / underscore — see `VAULT_NAME_CHARSET`).
+ * The `<name>` capture is reused by the prefix-strip below — keep the two in
+ * sync if this regex moves.
  */
-const ADMIN_SPA_MOUNT_RE = /^\/vault\/([^/]+)\/admin(?=\/|$)/;
+const ADMIN_SPA_MOUNT_RE = new RegExp(`^/vault/([${VAULT_NAME_CHARSET}]+)/admin(?=/|$)`);
 
 /**
  * Regex anchoring the DAEMON-LEVEL multi-vault SPA mount at `/vault/admin`

package/src/mirror-credentials.test.ts

@@ -104,6 +104,53 @@ describe("serialize + parse round-trip", () => {
     expect(out).toEqual(creds);
   });
 
+  test("github_oauth with persisted owner/name round-trips through the bytes (vault#401)", () => {
+    // owner/name are persisted at repo-select time so the selection survives a
+    // cleared git origin + restart. They must serialize and parse back
+    // byte-faithfully.
+    const creds: MirrorCredentials = {
+      active_method: "github_oauth",
+      github_oauth: {
+        access_token: "gho_abc123def456ghi789",
+        scope: "repo",
+        authorized_at: "2026-05-28T03:14:15.000Z",
+        user_login: "aaron",
+        user_id: 12345,
+        owner: "aaron",
+        name: "backup-repo",
+      },
+      pat: null,
+    };
+    const out = parseCredentials(serializeCredentials(creds));
+    expect(out).toEqual(creds);
+    expect(out.github_oauth?.owner).toBe("aaron");
+    expect(out.github_oauth?.name).toBe("backup-repo");
+  });
+
+  test("github_oauth WITHOUT owner/name stays byte-stable (back-compat)", () => {
+    // Credentials written before a repo is picked (or before vault#401) carry
+    // no owner/name. Serialize must NOT emit empty owner/name lines, and the
+    // round-trip must leave the fields absent (not "").
+    const creds: MirrorCredentials = {
+      active_method: "github_oauth",
+      github_oauth: {
+        access_token: "gho_abc123def456ghi789",
+        scope: "repo",
+        authorized_at: "2026-05-28T03:14:15.000Z",
+        user_login: "aaron",
+        user_id: 12345,
+      },
+      pat: null,
+    };
+    const serialized = serializeCredentials(creds);
+    expect(serialized).not.toContain("owner:");
+    expect(serialized).not.toContain("name:");
+    const out = parseCredentials(serialized);
+    expect(out).toEqual(creds);
+    expect(out.github_oauth?.owner).toBeUndefined();
+    expect(out.github_oauth?.name).toBeUndefined();
+  });
+
   test("github_oauth with empty scope round-trips (GitHub App tokens)", () => {
     // Tokens from the shared Parachute GitHub App carry scope: "" (GitHub
     // Apps use fine-grained permissions, not scopes). The empty string must

package/src/mirror-credentials.ts

@@ -86,6 +86,18 @@ export interface GitHubOAuthCredential {
   user_login: string;
   /** GitHub numeric user id — stable across login renames. */
   user_id: number;
+  /**
+   * The selected repo's owner — persisted at repo-select time (vault#401).
+   * Optional: absent before the operator picks a repo, and absent in
+   * credentials files written before this field existed (back-compat). When
+   * present, `applyCredentialsToRemote` reconstructs the authed remote URL
+   * from `owner`/`name` directly rather than regex-parsing the current git
+   * origin — so the selection survives the origin being cleared (e.g.
+   * `DELETE /auth` then re-OAuth) and a server restart.
+   */
+  owner?: string;
+  /** The selected repo's name — persisted alongside `owner` (vault#401). */
+  name?: string;
 }
 
 /**
@@ -138,6 +150,10 @@ export interface MirrorCredentialsPublic {
     scope: string;
     authorized_at: string;
     token_preview: string;
+    /** Selected repo owner, when a repo has been picked (vault#401). */
+    owner?: string;
+    /** Selected repo name, when a repo has been picked (vault#401). */
+    name?: string;
   } | null;
   pat: {
     label: string;
@@ -233,6 +249,15 @@ export function serializeCredentials(creds: MirrorCredentials): string {
     lines.push(`  authorized_at: ${quoteIfNeeded(creds.github_oauth.authorized_at)}`);
     lines.push(`  user_login: ${quoteIfNeeded(creds.github_oauth.user_login)}`);
     lines.push(`  user_id: ${creds.github_oauth.user_id}`);
+    // owner/name persisted at repo-select time (vault#401). Emitted only when
+    // present so credentials written before a repo is picked (or before this
+    // field existed) stay byte-stable.
+    if (creds.github_oauth.owner !== undefined) {
+      lines.push(`  owner: ${quoteIfNeeded(creds.github_oauth.owner)}`);
+    }
+    if (creds.github_oauth.name !== undefined) {
+      lines.push(`  name: ${quoteIfNeeded(creds.github_oauth.name)}`);
+    }
   } else {
     lines.push("github_oauth: null");
   }
@@ -356,6 +381,8 @@ export function parseCredentials(yaml: string): MirrorCredentials {
       else if (key === "scope") oauth.scope = parseScalar(rawVal!);
       else if (key === "authorized_at") oauth.authorized_at = parseScalar(rawVal!);
       else if (key === "user_login") oauth.user_login = parseScalar(rawVal!);
+      else if (key === "owner") oauth.owner = parseScalar(rawVal!);
+      else if (key === "name") oauth.name = parseScalar(rawVal!);
       else if (key === "user_id") {
         const n = Number(parseScalar(rawVal!));
         if (Number.isFinite(n)) oauth.user_id = n;
@@ -571,6 +598,12 @@ export function sanitizeCredentials(
           scope: creds.github_oauth.scope,
           authorized_at: creds.github_oauth.authorized_at,
           token_preview: previewToken(creds.github_oauth.access_token),
+          ...(creds.github_oauth.owner !== undefined
+            ? { owner: creds.github_oauth.owner }
+            : {}),
+          ...(creds.github_oauth.name !== undefined
+            ? { name: creds.github_oauth.name }
+            : {}),
         }
       : null,
     pat: creds.pat

package/src/mirror-manager.ts

@@ -1073,33 +1073,49 @@ export class MirrorManager {
         return;
       }
       // github_oauth: the active token is set, but a repo may not yet be
-      // picked. The select-repo route handler writes the URL; on a
-      // subsequent restart we can't reconstruct the URL without the
-      // owner/repo. Best-effort: if `origin` already points at a github.com
-      // URL, rewrite it with the stored token in case the token rotated.
+      // picked. The select-repo route handler writes the URL onto origin AND
+      // (vault#401) persists owner/name into the credentials struct.
       if (creds.active_method === "github_oauth" && creds.github_oauth) {
-        const current = await readCurrentOrigin(repoDir);
-        if (current && current.includes("github.com")) {
-          // Parse owner/repo out of the current URL.
-          const match = current.match(
-            /github\.com[/:]([^/]+)\/([^/.]+?)(?:\.git)?$/,
-          );
-          if (match) {
-            const [, owner, repo] = match;
-            const { githubAuthedRemoteUrl } = await import("./mirror-credentials.ts");
-            const authed = githubAuthedRemoteUrl(
-              creds.github_oauth.access_token,
-              owner!,
-              repo!,
+        // vault#401: prefer the persisted owner/name. Reconstructing the
+        // remote from credentials alone means the selection survives the
+        // origin being cleared (DELETE /auth then re-OAuth) across a restart —
+        // the bug class where regex-parsing the origin silently lost the repo.
+        const persistedOwner = creds.github_oauth.owner;
+        const persistedName = creds.github_oauth.name;
+        let owner: string | undefined;
+        let repo: string | undefined;
+        if (persistedOwner && persistedName) {
+          owner = persistedOwner;
+          repo = persistedName;
+        } else {
+          // Back-compat fallback: credentials written before #401 don't carry
+          // owner/name. Parse them out of the current github.com origin (the
+          // pre-#401 behavior) when origin is still present.
+          const current = await readCurrentOrigin(repoDir);
+          if (current && current.includes("github.com")) {
+            const match = current.match(
+              /github\.com[/:]([^/]+)\/([^/.]+?)(?:\.git)?$/,
             );
-            const result = await applyToGitRemote(repoDir, authed);
-            if (!result.ok) {
-              console.warn(
-                `[mirror] could not refresh github_oauth remote URL (non-fatal): ${result.error}`,
-              );
+            if (match) {
+              owner = match[1];
+              repo = match[2];
             }
           }
         }
+        if (owner && repo) {
+          const { githubAuthedRemoteUrl } = await import("./mirror-credentials.ts");
+          const authed = githubAuthedRemoteUrl(
+            creds.github_oauth.access_token,
+            owner,
+            repo,
+          );
+          const result = await applyToGitRemote(repoDir, authed);
+          if (!result.ok) {
+            console.warn(
+              `[mirror] could not refresh github_oauth remote URL (non-fatal): ${result.error}`,
+            );
+          }
+        }
       }
     } catch (err) {
       console.warn(

package/src/mirror-routes.test.ts

@@ -912,6 +912,84 @@ describe("auth credential routes — credential-save side-effects (Cuts 3 + 6)",
     await manager.stop();
   }, 30_000);
 
+  test("vault#401: owner/name survive a cleared origin + restart (persisted in creds, not just the git remote)", async () => {
+    // The bug: pre-#401, select-repo wrote owner/name ONLY into the git
+    // origin URL. On restart, applyCredentialsToRemote regex-parsed them back
+    // out of the origin — so clearing the origin (DELETE /auth → re-OAuth
+    // without re-selecting) silently lost the repo even with a valid token.
+    // Now select-repo persists owner/name into the credentials struct, and
+    // applyCredentialsToRemote prefers the persisted values. With the origin
+    // cleared, a restart still reconstructs the github.com remote.
+    home = tmp("mirror-selectrepo-persist-");
+    const { manager, deps } = makeManager(home);
+    const cfg = {
+      ...defaultMirrorConfig(),
+      enabled: true,
+      location: "internal" as const,
+      sync_mode: "manual" as const,
+      auto_commit: false,
+      auto_push: false,
+    };
+    // The manager reads config via deps.readMirrorConfig (in-memory); the
+    // route's history-on-link keys off the real per-vault file's existence.
+    // Seed both, same as the autopush test above.
+    deps.writeMirrorConfig(cfg);
+    writeMirrorConfigForVault("default", cfg);
+    await manager.start();
+    const mirrorPath = manager.getStatus().mirror_path;
+    expect(mirrorPath).toBeTruthy();
+
+    writeCredentials("default", {
+      active_method: "github_oauth",
+      github_oauth: {
+        access_token: "gho_persisttoken12345",
+        scope: "repo",
+        authorized_at: "2026-05-28T03:14:15.000Z",
+        user_login: "aaron",
+        user_id: 1,
+      },
+      pat: null,
+    });
+
+    const res = await handleAuthGithubSelectRepo(
+      new Request("http://x/select", {
+        method: "POST",
+        body: JSON.stringify({ owner: "aaron", name: "backup-repo" }),
+      }),
+      manager,
+    );
+    expect(res.status).toBe(200);
+
+    // The fix: owner/name persisted into the credentials struct (not just origin).
+    const persisted = readCredentials("default");
+    expect(persisted?.github_oauth?.owner).toBe("aaron");
+    expect(persisted?.github_oauth?.name).toBe("backup-repo");
+
+    // Simulate the DELETE /auth + re-OAuth-without-reselect path: the OAuth
+    // token survives, but the git origin gets cleared.
+    Bun.spawnSync(["git", "remote", "remove", "origin"], { cwd: mirrorPath! });
+    const afterClear = Bun.spawnSync(["git", "remote", "get-url", "origin"], {
+      cwd: mirrorPath!,
+    });
+    expect(afterClear.exitCode).not.toBe(0); // origin is gone
+
+    // Restart — applyCredentialsToRemote runs again. Pre-#401 it would find no
+    // origin to parse and leave the remote unset; post-#401 it rebuilds from
+    // the persisted owner/name.
+    await manager.stop();
+    await manager.start();
+
+    const reapplied = Bun.spawnSync(["git", "remote", "get-url", "origin"], {
+      cwd: mirrorPath!,
+    });
+    expect(reapplied.exitCode).toBe(0);
+    const reappliedUrl = reapplied.stdout.toString().trim();
+    // The remote was reconstructed from persisted owner/name (token embedded,
+    // not asserted here). Without persistence this would be empty.
+    expect(reappliedUrl).toContain("github.com/aaron/backup-repo");
+    await manager.stop();
+  }, 30_000);
+
   test("select-repo is a no-op for auto_push when mirror is disabled", async () => {
     // Operator wiring credentials before flipping the mirror on — don't
     // mutate auto_push behind their back.

package/src/mirror-routes.ts

@@ -1200,6 +1200,19 @@ export async function handleAuthGithubSelectRepo(
     }
   }
 
+  // vault#401: persist the selected owner/name INTO the credentials struct,
+  // not only into the git origin URL. Pre-#401 the selection lived solely in
+  // the origin URL; `applyCredentialsToRemote` regex-parsed it back out on
+  // restart, so clearing the origin (e.g. `DELETE /auth` then re-OAuth without
+  // re-selecting) silently lost the repo even with a still-valid token. Saving
+  // it here lets the restart path reconstruct the remote from credentials
+  // alone. Write before the remote-apply so the persisted selection survives
+  // even if the apply later fails.
+  writeCredentials(manager.getVaultName(), {
+    ...creds,
+    github_oauth: { ...creds.github_oauth, owner, name },
+  });
+
   // Reach into mirror-credentials.ts for the authed URL builder.
   const { githubAuthedRemoteUrl } = await import("./mirror-credentials.ts");
   const authedUrl = githubAuthedRemoteUrl(