@openparachute/vault 0.7.6-rc.1 → 0.7.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openparachute/vault",
-  "version": "0.7.6-rc.1",
+  "version": "0.7.6",
   "description": "Agent-native knowledge graph. Notes, tags, links over MCP.",
   "module": "src/cli.ts",
   "type": "module",

package/src/auth-hub-jwt.test.ts

@@ -21,7 +21,7 @@
  * wiring and the response-shape contract.
  */
 
-import { describe, test, expect, beforeEach, afterEach, spyOn } from "bun:test";
+import { describe, test, expect, beforeAll, beforeEach, afterEach, spyOn } from "bun:test";
 import { mkdirSync, rmSync, existsSync } from "fs";
 import { join } from "path";
 import { tmpdir } from "os";
@@ -147,6 +147,15 @@ let prevJwksOrigin: string | undefined;
 let fixture: HubFixture;
 let kp: Keypair;
 
+beforeAll(async () => {
+  // RSA keygen is the expensive part of this file (~tens of ms locally,
+  // hundreds under a loaded full-suite worker). Doing it per-test is what
+  // clustered failures under parallel contention (vault#609): 30 tests ×
+  // generateKeyPair competing with the rest of `bun test ./src/` blew the
+  // 5s default. One keypair is enough — kid, n, e are stable for the file.
+  kp = await makeKeypair("k1");
+});
+
 beforeEach(async () => {
   tmpHome = join(
     tmpdir(),
@@ -157,7 +166,6 @@ beforeEach(async () => {
   process.env.PARACHUTE_HOME = tmpHome;
   clearVaultStoreCache();
 
-  kp = await makeKeypair("k1");
   fixture = startHubFixture([kp]);
   prevHubOrigin = process.env.PARACHUTE_HUB_ORIGIN;
   prevJwksOrigin = process.env.PARACHUTE_HUB_JWKS_ORIGIN;

package/src/export-watch.test.ts

@@ -828,11 +828,13 @@ describe("export CLI: --watch", () => {
       const watch = spawnWatchCli(["export", exportDir, "--watch", "--interval", "1"], tmp);
       try {
         // Initial export prints the "Exported N notes" line.
-        await watch.awaitLine((l) => l.includes("Exported 1 note"), 10_000);
+        await watch.awaitLine((l) => l.includes("Exported 1 note"), 15_000);
         // Watch loop prints the polling banner.
-        await watch.awaitLine((l) => l.includes("[watch] polling every 1s"), 5_000);
-        // At least one idle tick.
-        await watch.awaitLine((l) => l.includes("[watch] no changes"), 5_000);
+        await watch.awaitLine((l) => l.includes("[watch] polling every 1s"), 15_000);
+        // At least one idle tick. 15s not 5s: under full-suite spawn
+        // contention the child can take >5s to print its first idle tick
+        // even with --interval 1 (vault#609).
+        await watch.awaitLine((l) => l.includes("[watch] no changes"), 15_000);
       } finally {
         watch.proc.kill("SIGINT");
       }
@@ -841,7 +843,7 @@ describe("export CLI: --watch", () => {
       // Stopping line printed on shutdown.
       expect(watch.seenLines.some((l) => l.includes("[watch] stopping watch"))).toBe(true);
     },
-    30_000,
+    60_000,
   );
 
   test(
@@ -849,7 +851,7 @@ describe("export CLI: --watch", () => {
     async () => {
       const watch = spawnWatchCli(["export", exportDir, "--watch", "--interval", "1"], tmp);
       try {
-        await watch.awaitLine((l) => l.includes("[watch] polling every 1s"), 10_000);
+        await watch.awaitLine((l) => l.includes("[watch] polling every 1s"), 15_000);
 
         // Open the vault DB out-of-band and add a note. The watch loop
         // should pick it up within ~2 intervals.
@@ -866,7 +868,7 @@ describe("export CLI: --watch", () => {
         // Expect the watch-mode incremental-export line.
         const line = await watch.awaitLine(
           (l) => l.startsWith("[watch] exported"),
-          10_000,
+          15_000,
         );
         expect(line).toMatch(/\[watch\] exported \d+ note/);
         // And the on-disk file landed.
@@ -878,7 +880,7 @@ describe("export CLI: --watch", () => {
       await watch.proc.exited;
       expect(fs.existsSync(path.join(exportDir, "Inbox", "triggered.md"))).toBe(true);
     },
-    30_000,
+    60_000,
   );
 
   test(
@@ -925,8 +927,8 @@ describe("export CLI: --watch", () => {
       );
       try {
         // Initial export must succeed (seed has no collision).
-        await watch.awaitLine((l) => l.includes("Exported 1 note"), 10_000);
-        await watch.awaitLine((l) => l.includes("[watch] polling every 1s"), 5_000);
+        await watch.awaitLine((l) => l.includes("Exported 1 note"), 15_000);
+        await watch.awaitLine((l) => l.includes("[watch] polling every 1s"), 15_000);
 
         // Inject a collision: existing seed is `Inbox/seed`; write
         // `Inbox/SEED` so the lowercased (path, ext) key collides.
@@ -977,7 +979,7 @@ describe("export CLI: --watch", () => {
       expect(stderr).toContain("Resolve the collision in the vault");
       expect(stderr).toContain("--strict-case-collision");
     },
-    30_000,
+    60_000,
   );
 
   test(
@@ -993,9 +995,9 @@ describe("export CLI: --watch", () => {
         tmp,
       );
       try {
-        await watch.awaitLine((l) => l.includes("[watch] polling every 1s"), 10_000);
+        await watch.awaitLine((l) => l.includes("[watch] polling every 1s"), 15_000);
         // Initial export should have produced a commit.
-        await watch.awaitLine((l) => l.startsWith("[git-commit] export:"), 10_000);
+        await watch.awaitLine((l) => l.startsWith("[git-commit] export:"), 15_000);
         const afterInitial = gitLogOneline(exportDir).length;
 
         // Add a note → expect another commit on the next cycle.
@@ -1023,6 +1025,6 @@ describe("export CLI: --watch", () => {
       }
       await watch.proc.exited;
     },
-    30_000,
+    60_000,
   );
 });

package/src/mcp-tools.ts

@@ -883,9 +883,13 @@ function overrideVaultInfo(
  * model error), the cap is the backstop. Operators wanting long-lived
  * tokens mint a hub-issued JWT via the hub mint-token flow (the REST
  * /vault/<name>/tokens endpoint was removed with the pvt_* drop, vault#282).
+ * The `long_lived: true` opt-in deliberately relaxes this to a 90-day
+ * ceiling for standing credentials; the caller's admin JWT could already
+ * mint longer directly from the hub, so the flag adds no new authority.
  */
 const MANAGE_TOKEN_DEFAULT_TTL_SECONDS = 900; // 15 minutes
 const MANAGE_TOKEN_MAX_TTL_SECONDS = 3600; // 1 hour
+const MANAGE_TOKEN_LONG_TTL_MAX_SECONDS = 7776000; // 90 days; opt-in ceiling for `long_lived: true`, matching hub's API_MINT_TOKEN_DEFAULT_TTL_SECONDS
 
 /**
  * Resolve the bare hub origin for the mint/revoke proxy calls. Reuses
@@ -952,8 +956,10 @@ function buildManageTokenTool(
       "escalate. Minting requires a hub-JWT session holding 'vault:" + vaultName +
       ":admin'. List + revoke are scoped to tokens this session minted; " +
       "CLI/REST-minted tokens are not surfaced here.\n\n" +
+      "`long_lived: true` raises the mint TTL cap to 90 days; a 90-day token is a " +
+      "standing credential and meaningfully increases blast radius if leaked/misused.\n\n" +
       "Actions (discriminator: `action`):\n" +
-      "- `mint` — { scope: string|string[], ttl_seconds?: number, description?: string } → { action: \"mint\", token, jti, expires_at, scopes, scoped_tags, vault_name } (vault#555: scopes/scoped_tags/vault_name were previously undocumented here)\n" +
+      "- `mint` — { scope: string|string[], ttl_seconds?: number, long_lived?: boolean, description?: string } → { action: \"mint\", token, jti, expires_at, scopes, scoped_tags, vault_name } (vault#555: scopes/scoped_tags/vault_name were previously undocumented here)\n" +
       "- `revoke` — { jti: string } → { action: \"revoke\", ok: boolean, already_revoked?: boolean } — idempotent; a jti not in this session's ledger, or already revoked, still returns ok:true. A genuine failure additionally carries error/message (and, for a hub-side rejection, hub_status).\n" +
       "- `list` — (no inputs) → { action: \"list\", tokens: [...] }",
     inputSchema: {
@@ -974,7 +980,11 @@ function buildManageTokenTool(
         },
         ttl_seconds: {
           type: "number",
-          description: `(action=mint) Token lifetime in seconds. Default ${MANAGE_TOKEN_DEFAULT_TTL_SECONDS} (15 min), max ${MANAGE_TOKEN_MAX_TTL_SECONDS} (1 hour). Values outside (0, ${MANAGE_TOKEN_MAX_TTL_SECONDS}] are rejected.`,
+          description: `(action=mint) Token lifetime in seconds. Default ${MANAGE_TOKEN_DEFAULT_TTL_SECONDS} (15 min), max ${MANAGE_TOKEN_MAX_TTL_SECONDS} (1 hour); with long_lived=true, max ${MANAGE_TOKEN_LONG_TTL_MAX_SECONDS} (90 days). Values outside the applicable (0, max] range are rejected.`,
+        },
+        long_lived: {
+          type: "boolean",
+          description: "(action=mint, optional) Set true to raise the TTL cap from 1 hour to 90 days. A 90-day token is a standing credential: long-lived and meaningfully increases blast radius if leaked/misused.",
         },
         description: {
           type: "string",
@@ -1107,9 +1117,20 @@ async function mintAction(
   }
 
   // TTL bounds. Default 900 (15 min); explicit values must satisfy
-  // `0 < ttl <= MANAGE_TOKEN_MAX_TTL_SECONDS`. Zero, negative, NaN, and
-  // beyond-max all reject — the cap is the safety backstop if revoke fails,
-  // so it must be strict.
+  // `0 < ttl <= MANAGE_TOKEN_MAX_TTL_SECONDS`, or
+  // `0 < ttl <= MANAGE_TOKEN_LONG_TTL_MAX_SECONDS` with `long_lived: true`.
+  // Zero, negative, NaN, and beyond-max all reject — the cap is the safety
+  // backstop if revoke fails, so it must be strict.
+  if (params.long_lived !== undefined && typeof params.long_lived !== "boolean") {
+    return {
+      action: "mint",
+      error: "invalid_request",
+      message: "manage-token mint: long_lived must be a boolean.",
+    };
+  }
+  const maxTtl = params.long_lived === true
+    ? MANAGE_TOKEN_LONG_TTL_MAX_SECONDS
+    : MANAGE_TOKEN_MAX_TTL_SECONDS;
   let ttl = MANAGE_TOKEN_DEFAULT_TTL_SECONDS;
   if (params.ttl_seconds !== undefined && params.ttl_seconds !== null) {
     if (typeof params.ttl_seconds !== "number" || !Number.isFinite(params.ttl_seconds)) {
@@ -1119,11 +1140,11 @@ async function mintAction(
         message: "manage-token mint: ttl_seconds must be a finite number.",
       };
     }
-    if (params.ttl_seconds <= 0 || params.ttl_seconds > MANAGE_TOKEN_MAX_TTL_SECONDS) {
+    if (params.ttl_seconds <= 0 || params.ttl_seconds > maxTtl) {
       return {
         action: "mint",
         error: "invalid_request",
-        message: `manage-token mint: ttl_seconds must be in (0, ${MANAGE_TOKEN_MAX_TTL_SECONDS}]; got ${params.ttl_seconds}.`,
+        message: `manage-token mint: ttl_seconds must be in (0, ${maxTtl}]; got ${params.ttl_seconds}.`,
       };
     }
     ttl = params.ttl_seconds;

package/src/vault.test.ts

@@ -7598,6 +7598,23 @@ describe("manage-token MCP tool (vault#403, MGT — hub-JWT attenuation proxy)",
     closeAllStores();
   });
 
+  test("long_lived=true permits a 30-day TTL", async () => {
+    installHubStub();
+    const { vaultName, auth } = await setupAdminSession("mint-long-lived");
+    const { closeAllStores } = await import("./vault-store.ts");
+    const { parsed } = await callTool(vaultName, auth, "manage-token", {
+      action: "mint",
+      scope: "vault:read",
+      ttl_seconds: 2592000,
+      long_lived: true,
+    });
+    expect(parsed.action).toBe("mint");
+    expect(parsed.error).toBeUndefined();
+    const mint = hubCalls.find((c) => c.url.endsWith("/api/auth/mint-token"));
+    expect(mint!.body.expires_in).toBe(2592000);
+    closeAllStores();
+  });
+
   test("tag-scoped caller's mint includes permissions.scoped_tags", async () => {
     installHubStub();
     const { vaultName, auth } = await setupAdminSession("mint-scoped", ["task", "project"]);
@@ -7625,6 +7642,52 @@ describe("manage-token MCP tool (vault#403, MGT — hub-JWT attenuation proxy)",
     const { closeAllStores } = await import("./vault-store.ts");
     const { parsed } = await callTool(vaultName, auth, "manage-token", { action: "mint", scope: "vault:read", ttl_seconds: 3601 });
     expect(parsed.error).toBe("invalid_request");
+    expect(parsed.message).toBe("manage-token mint: ttl_seconds must be in (0, 3600]; got 3601.");
+    expect(hubCalls.length).toBe(0);
+    closeAllStores();
+  });
+
+  test("long_lived=true rejects TTL above the 90-day cap locally", async () => {
+    installHubStub();
+    const { vaultName, auth } = await setupAdminSession("mint-long-over");
+    const { closeAllStores } = await import("./vault-store.ts");
+    const { parsed } = await callTool(vaultName, auth, "manage-token", {
+      action: "mint",
+      scope: "vault:read",
+      ttl_seconds: 7776001,
+      long_lived: true,
+    });
+    expect(parsed.error).toBe("invalid_request");
+    expect(parsed.message).toContain("7776000");
+    expect(hubCalls.length).toBe(0);
+    closeAllStores();
+  });
+
+  test("long_lived=false keeps the 1-hour cap", async () => {
+    installHubStub();
+    const { vaultName, auth } = await setupAdminSession("mint-long-false");
+    const { closeAllStores } = await import("./vault-store.ts");
+    const { parsed } = await callTool(vaultName, auth, "manage-token", {
+      action: "mint",
+      scope: "vault:read",
+      ttl_seconds: 7200,
+      long_lived: false,
+    });
+    expect(parsed.error).toBe("invalid_request");
+    expect(hubCalls.length).toBe(0);
+    closeAllStores();
+  });
+
+  test("omitted long_lived keeps the 1-hour cap", async () => {
+    installHubStub();
+    const { vaultName, auth } = await setupAdminSession("mint-long-omitted");
+    const { closeAllStores } = await import("./vault-store.ts");
+    const { parsed } = await callTool(vaultName, auth, "manage-token", {
+      action: "mint",
+      scope: "vault:read",
+      ttl_seconds: 7200,
+    });
+    expect(parsed.error).toBe("invalid_request");
     expect(hubCalls.length).toBe(0);
     closeAllStores();
   });