@bongos/core 1.19.1033 → 1.19.1035

package/tests/core_upgrade_runner.mjs

@@ -31,7 +31,8 @@ import { createRequire } from 'node:module';
 import fs from 'node:fs';
 import path from 'node:path';
 // An ESM named import, not R.parseSchemaPending: knip credits a CJS export only when a test imports it this way.
-import { parseSchemaPending } from '../scripts/gds/provision-core-upgrade.js';
+import { parseSchemaPending, repoNote, REPO_NOTES } from '../scripts/gds/provision-core-upgrade.js';
+import { parseRepoNote } from '../modules/provisioning/core-upgrade.js';
 
 const require = createRequire(import.meta.url);
 const R = require('../scripts/gds/provision-core-upgrade.js');
@@ -196,9 +197,9 @@ await t('and an ordinary slug still runs', async () => {
 });
 
 await t('the guard error carries a status and a sentence, so a route CAN answer with it', async () => {
-  // No route maps it today — reaching it means a route forgot its own check, which
-  // deserves a 500 and a stack. The fields exist so that stays a choice rather than a
-  // rewrite, and so the wording is settled once.
+  // Every route answers it through failFrom now (task 1004126): the owner reads this
+  // sentence as a 409, and the route still logs the stack. The wording is settled here,
+  // once; tests/provisioning_public_refusal.mjs pins that it arrives.
   const selfRow = { query: async () => ({ rows: [{ hosting_shape: 'control-plane' }] }) };
   await assert.rejects(() => G.assertIntentAllowed(selfRow, 1, 'teardown'), (err) => {
     assert.equal(err.code, 'control_plane_protected');
@@ -1159,5 +1160,240 @@ await t('the dry run records the list beside the verdict, keyed to where the box
   assert.equal(stored.changes.entries[0].text, 'a thing landed');
 });
 
+console.log('\nthe pin reaches the project\'s GitHub repo — pushed from the HUB (task 1004065):');
+
+// THE BUG. A hosted project's upgrade runs connected to the PROJECT's database, which
+// has no provisioning table (ADR 0281), so upgrade.js could never find the owner's
+// token, fell back to `git push origin` over a read-only deploy key (ADR 0176), was
+// refused, and the intent still resolved `done`. hermeslines-marketing's box ran
+// 1.19.994 while its GitHub repo still pinned 1.19.881. These cases drive the whole
+// move so the push is proven to happen, from where the token actually lives, AFTER a
+// confirmed upgrade, and to be reported when it cannot.
+
+const OWNER_TOKEN = 'ghu_OWNER_TOKEN_never_in_a_command';
+
+function pinDeps({ served = '1.19.762', token = OWNER_TOKEN, branch = 'main', pushResult = null, originResult = null, upgradeThrows = false } = {}) {
+  const d = makeDeps({ served });
+  const ran = [];
+  const writes = [];
+  const tokenAsks = [];
+  d.ran = [];
+  d.ranWith = ran;
+  d.exec = (cmd, opts) => {
+    ran.push({ cmd, cwd: opts && opts.cwd, env: opts && opts.env });
+    d.ran.push(cmd);
+    if (/upgrade\.js/.test(cmd) && upgradeThrows) throw new Error('health check failed after restart — rolled back');
+    if (/\/version/.test(cmd)) return { ok: true, stdout: JSON.stringify({ coreVersion: served }) };
+    if (/symbolic-ref/.test(cmd)) {
+      return branch ? { ok: true, stdout: `${branch}\n` } : { ok: true, softFailed: true, stdout: '', stderr: 'fatal: ref HEAD is not a symbolic ref' };
+    }
+    if (/push https:\/\/x-access-token@github\.com\//.test(cmd)) return pushResult || { ok: true, stdout: '' };
+    if (/ push origin /.test(cmd)) return originResult || { ok: true, stdout: '' };
+    return { ok: true, stdout: '' };
+  };
+  d.controlWriteFile = (p, body, o) => { writes.push({ p, body, mode: o && o.mode }); return { ok: true }; };
+  d.getGithubToken = async (builderId) => { tokenAsks.push(builderId); return token ? { token } : null; };
+  d._writes = writes;
+  d._tokenAsks = tokenAsks;
+  return d;
+}
+
+const hosted = (over = {}) => inst({
+  hosting_shape: 'cloud-host', slug: 'acme-site', port: 3011, db_name: 'acme-site',
+  target_ref: 'acme/site', owner_builder_id: 5, ...over,
+});
+const tokenPush = (d) => d.ranWith.find((c) => /push https:\/\/x-access-token@github\.com\//.test(c.cmd));
+const originPush = (d) => d.ranWith.find((c) => / push origin /.test(c.cmd));
+const refusedBy = (stderr) => ({ ok: true, softFailed: true, stdout: '', stderr });
+
+await t('a hosted project\'s upgrade COMMITS the pin on the box and leaves the push to the hub', async () => {
+  const d = pinDeps();
+  await R.coreUpgradeInstance(hosted(), d, intent());
+  const cmd = upgradeCall(d);
+  assert.ok(cmd.includes('--commit-pin'), 'the pin is still committed — an uncommitted pin is the silent-revert bug');
+  assert.ok(cmd.includes('--pin-no-push'), 'and upgrade.js no longer attempts a push it has no credential for');
+});
+
+await t('the platform itself keeps pushing its own pin — its key CAN write its own repo', async () => {
+  const d = makeDeps({ served: '1.19.762' });
+  await R.coreUpgradeInstance(inst(), d, intent());
+  assert.doesNotMatch(upgradeCall(d), /--pin-no-push/, 'unchanged for the control plane');
+});
+
+await t('the preview carries no push flag at all — it never gets as far as a pin', () => {
+  const peek = R.upgradeInvocation(hosted(), '1.19.762', { dryRun: true });
+  assert.doesNotMatch(peek.cmd, /--pin-no-push|--commit-pin/);
+});
+
+await t('THE HUB PUSHES the committed pin to the project\'s repo with the owner\'s token read from the HUB db', async () => {
+  const d = pinDeps();
+  const r = await R.coreUpgradeInstance(hosted(), d, intent());
+  assert.equal(r.ok, true);
+  assert.deepEqual(d._tokenAsks, [5], 'the OWNER\'s token, looked up by the owner id on the provisioning row');
+  const push = tokenPush(d);
+  assert.ok(push, 'the hub pushed');
+  assert.ok(push.cmd.includes('https://x-access-token@github.com/acme/site.git HEAD:main'), `to the row's target_ref, main — got ${push.cmd}`);
+  assert.ok(push.cmd.includes(`-C ${RP.standaloneRoot(hosted())} `), 'from the project\'s own checkout');
+  assert.equal(r.repo.pushed, true);
+  assert.equal(r.repo.via, 'owner-token');
+  assert.ok(!r.doneNote, 'a clean push leaves nothing to report');
+});
+
+await t('the push happens AFTER the confirmed upgrade, never before it', async () => {
+  const d = pinDeps();
+  await R.coreUpgradeInstance(hosted(), d, intent());
+  const at = (re) => d.ranWith.findIndex((c) => re.test(c.cmd));
+  assert.ok(at(/upgrade\.js/) >= 0 && at(/upgrade\.js/) < at(/x-access-token@github\.com/), 'the pin must exist before it can be pushed');
+});
+
+await t('the TOKEN never appears in a command line, and its credential file is removed', async () => {
+  const d = pinDeps();
+  await R.coreUpgradeInstance(hosted(), d, intent());
+  for (const c of d.ranWith) assert.ok(!c.cmd.includes(OWNER_TOKEN), `argv reaches ps and the journal — leaked in: ${c.cmd}`);
+  assert.equal(d._writes.length, 1, 'one credential file');
+  const cred = d._writes[0];
+  assert.ok(cred.body.includes(OWNER_TOKEN), 'the token rides a file');
+  assert.equal(cred.mode, 0o600, 'readable by the runner alone');
+  assert.ok(tokenPush(d).cmd.includes(`store --file=${cred.p}`), 'git reads it through the store helper');
+  assert.ok(d.ranWith.some((c) => c.cmd === `rm -f ${cred.p}`), 'and it is deleted afterwards');
+});
+
+await t('the push is HARDENED: helper list reset, no hooks, no prompt', async () => {
+  // Helpers are cumulative — a global one would answer first with some other account.
+  // A hook in the project's checkout would otherwise run as the RUNNER on this push.
+  const d = pinDeps();
+  await R.coreUpgradeInstance(hosted(), d, intent());
+  const push = tokenPush(d);
+  assert.match(push.cmd, /-c credential\.helper= -c credential\.helper='store --file=/, 'the empty entry resets the list first');
+  assert.match(push.cmd, /-c core\.hooksPath=\/dev\/null /, 'no hook runs');
+  assert.equal(push.env && push.env.GIT_TERMINAL_PROMPT, '0', 'a refused credential fails instead of waiting at a prompt');
+  assert.doesNotMatch(push.cmd, /--force|\+HEAD/, 'never forced');
+});
+
+await t('the credential file is removed even when the push FAILS', async () => {
+  const d = pinDeps({ pushResult: refusedBy('remote: Write access to repository not granted.\nfatal: unable to access: The requested URL returned error: 403') });
+  await R.coreUpgradeInstance(hosted(), d, intent());
+  assert.ok(d.ranWith.some((c) => c.cmd === `rm -f ${d._writes[0].p}`));
+});
+
+await t('NO TOKEN STORED: the box\'s own remote is tried, and a refusal resolves done WITH a note', async () => {
+  const d = pinDeps({ token: null, originResult: refusedBy('ERROR: The key you are authenticating with has been marked as read only.\nfatal: Could not read from remote repository.') });
+  const r = await R.coreUpgradeInstance(hosted(), d, intent());
+  assert.equal(r.ok, true, 'the upgrade DID land and the site runs it — that is not a failure');
+  assert.ok(originPush(d), 'the remote was tried, in case it can write');
+  assert.equal(d._writes.length, 0, 'no credential file without a credential');
+  assert.equal(r.repo.pushed, false);
+  assert.equal(r.repo.code, 'no_access');
+  assert.match(r.doneNote, /^repo_not_updated:no_access: /, 'the note the web tier reads');
+  assert.match(r.doneNote, /an hour/, 'and it says WHY there was no access, in words');
+});
+
+await t('NO TOKEN, but the box\'s remote CAN write: pushed that way, nothing to report', async () => {
+  const d = pinDeps({ token: null });
+  const r = await R.coreUpgradeInstance(hosted(), d, intent());
+  assert.equal(r.repo.pushed, true);
+  assert.equal(r.repo.via, 'origin');
+  assert.ok(!r.doneNote);
+  assert.match(originPush(d).cmd, /-c core\.hooksPath=\/dev\/null /, 'hardened the same way');
+});
+
+await t('GitHub REFUSES the owner\'s token: named as a refusal, not as "no token stored"', async () => {
+  const d = pinDeps({ pushResult: refusedBy('remote: Write access to repository not granted.\nfatal: unable to access: The requested URL returned error: 403') });
+  const r = await R.coreUpgradeInstance(hosted(), d, intent());
+  assert.equal(r.repo.code, 'refused');
+  assert.match(r.doneNote, /^repo_not_updated:refused: /);
+  assert.match(r.doneNote, /Write access to repository not granted/, 'GitHub\'s own words ride along');
+  assert.equal(originPush(d), undefined, 'a read-only remote cannot succeed where the token was refused');
+});
+
+await t('GitHub HAS COMMITS THE BOX DOES NOT: reported, and nothing is forced over them', async () => {
+  const d = pinDeps({ pushResult: refusedBy(' ! [rejected]        HEAD -> main (fetch first)\nerror: failed to push some refs to \'https://github.com/acme/site.git\'') });
+  const r = await R.coreUpgradeInstance(hosted(), d, intent());
+  assert.equal(r.repo.code, 'behind');
+  assert.match(r.doneNote, /^repo_not_updated:behind: /);
+  assert.ok(!d.ranWith.some((c) => /--force|\+HEAD|reset --hard|rebase/.test(c.cmd)), 'the box never rewrites anyone\'s history');
+});
+
+await t('a push that fails some OTHER way is reported with git\'s line, not guessed at', async () => {
+  const d = pinDeps({ pushResult: refusedBy('fatal: unable to access \'https://github.com/acme/site.git/\': Could not resolve host: github.com') });
+  const r = await R.coreUpgradeInstance(hosted(), d, intent());
+  assert.equal(r.repo.code, 'failed');
+  assert.match(r.doneNote, /Could not resolve host/);
+});
+
+await t('NO REPOSITORY RECORDED: reported, and no git is run after the upgrade', async () => {
+  const d = pinDeps();
+  const r = await R.coreUpgradeInstance(hosted({ target_ref: null }), d, intent());
+  assert.equal(r.repo.code, 'no_repo');
+  assert.match(r.doneNote, /^repo_not_updated:no_repo: /);
+  assert.equal(d._tokenAsks.length, 0, 'no token is read for a push that cannot happen');
+  assert.ok(!d.ranWith.some((c) => /\bgit\b/.test(c.cmd)), 'nothing touched the checkout');
+});
+
+await t('a checkout not on a branch is pushed NOWHERE — HEAD:main from a detached head would be a guess', async () => {
+  const d = pinDeps({ branch: null });
+  const r = await R.coreUpgradeInstance(hosted(), d, intent());
+  assert.equal(r.repo.code, 'no_branch');
+  assert.equal(tokenPush(d), undefined);
+  assert.equal(d._tokenAsks.length, 0, 'and no token is read for it');
+});
+
+await t('a branch name that is not a plain ref never reaches the shell', async () => {
+  const d = pinDeps({ branch: 'main;touch /tmp/pwn' });
+  const r = await R.coreUpgradeInstance(hosted(), d, intent());
+  assert.equal(r.repo.code, 'no_branch');
+  assert.ok(!d.ranWith.some((c) => /pwn/.test(c.cmd)), 'the name was refused, not interpolated');
+});
+
+await t('a FAILED upgrade pushes nothing — only a confirmed pin is worth saving', async () => {
+  const d = pinDeps({ upgradeThrows: true });
+  const r = await R.coreUpgradeInstance(hosted(), d, intent());
+  assert.equal(r.ok, false);
+  assert.equal(tokenPush(d), undefined);
+  assert.equal(d._tokenAsks.length, 0);
+});
+
+await t('the event log says GitHub was not updated, so the history is not a clean success either', async () => {
+  const events = [];
+  const d = pinDeps({ token: null, originResult: refusedBy('ERROR: The key you are authenticating with has been marked as read only.') });
+  d.provisioning = { ...d.provisioning, recordEvent: async (_db, e) => { events.push(e); } };
+  await R.coreUpgradeInstance(hosted(), d, intent());
+  assert.equal(events.length, 1);
+  assert.match(events[0].detail, /GitHub was not updated/);
+});
+
+await t('every note the runner writes is one the web tier reads back, code and sentence intact', () => {
+  for (const code of Object.keys(REPO_NOTES)) {
+    const note = repoNote(code, '(git: something)');
+    const w = parseRepoNote(note);
+    assert.ok(w, `${code} parses`);
+    assert.equal(w.code, code);
+    assert.ok(w.text.startsWith(REPO_NOTES[code]), `${code}: the sentence survives`);
+    assert.ok(note.length <= 600, `${code}: fits the page's bound`);
+  }
+});
+
+await t('the DRAIN LOOP resolves a done-with-a-note move WITH its note, still as done', async () => {
+  // Driven through the real dispatch: the note is only worth anything if it reaches the
+  // intent row the deploy page reads.
+  const P2 = require('../scripts/gds/provision.js');
+  let claims = 0; const resolved = []; const statusWrites = [];
+  const d = pinDeps({ token: null, originResult: refusedBy('ERROR: The key you are authenticating with has been marked as read only.') });
+  d.provisioning = {
+    claimNextIntent: async () => (claims++ === 0 ? { id: 12, instance_id: 7, action: 'core-upgrade', attempts: 1, target_version: '1.19.762', requested_by: 'api:archon:42' } : null),
+    getInstanceById: async () => hosted(),
+    resolveIntent: async (_db, id, state, note) => { resolved.push({ id, state, note }); },
+    setInstanceStatus: async (_db, _id, s, patch) => { statusWrites.push({ s, patch }); },
+    recordEvent: async () => {}, clearErrorNote: async () => {},
+    claimNextOAuthManifest: async () => null, resolveOAuthManifest: async () => {},
+  };
+  const r = await P2.cmdRunIntents(d);
+  assert.equal(r.errors, 0, JSON.stringify(r));
+  assert.equal(resolved.length, 1);
+  assert.equal(resolved[0].state, 'done', 'the upgrade landed — never an error');
+  assert.match(String(resolved[0].note), /^repo_not_updated:no_access: /, 'and the note travels to the row');
+  assert.equal(statusWrites.length, 0, 'a healthy instance is not marked anything');
+});
+
 console.log(`\ncore_upgrade_runner: ${passed} passed, ${failed} failed`);
 if (failed) process.exit(1);

package/tests/credential_presence.mjs

@@ -0,0 +1,153 @@
+// tests/credential_presence.mjs — the host credential sweep reports names and presence,
+// never a value, and the inventory it sweeps is the one docs/credentials.md documents
+// (task 1002880).
+//
+// Every value below is invented for the test and is chosen to be easy to spot: the
+// "never a value" cases scan the whole report for every value AND every 4-character
+// fragment of one, because a leak of a prefix ("ghp_…") is still a leak.
+//
+// Run:  node --test tests/credential_presence.mjs
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { spawnSync } from 'node:child_process';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const SCRIPT = path.join(ROOT, 'scripts', 'gds', 'credential-presence.js');
+const { CREDENTIALS, parseEnvFile, sweep, format, readFiles } = require('../scripts/gds/credential-presence.js');
+const { envPrefix } = require('../src/instance-config.js');
+const P = envPrefix();
+
+// Random-looking on purpose: a value that shares four characters with a variable name
+// ("CLIE" in CLIENT_ID) would make the fragment scan below flag the name, not a leak.
+const SECRETS = {
+  client: 'q7Zx9vLp2Rk8', pat: 'w3Ty6uHb1Nm4', box: 'e5Rc8oJd0Qs2', key: 'f9Gh2kAa7Vb3',
+};
+const WEB_ENV = [
+  '# /etc/example/web.env — test fixture',
+  `${P}_GITHUB_CLIENT_ID=Iv1clientIDqq9`,
+  `${P}_GITHUB_CLIENT_SECRET="${SECRETS.client}"`,
+  `GITHUB_PUSH_TOKEN=${SECRETS.pat}`,
+  `${P}_GITHUB_OWNER=example-owner`,
+  `${P}_GITHUB_REPO=example-repo`,
+  `BUILDER_SECRET_KEY=${SECRETS.key}`,
+  'DISCORD_BOT_TOKEN=',
+  'PORT=4100',
+].join('\n');
+
+function fragmentsOf(value) {
+  const out = new Set([value]);
+  for (let i = 0; i + 4 <= value.length; i++) out.add(value.slice(i, i + 4));
+  return [...out];
+}
+function assertNoValueIn(text) {
+  for (const v of Object.values(SECRETS)) {
+    for (const frag of fragmentsOf(v)) assert.ok(!text.includes(frag), `the report leaked a fragment of a value: "${frag}"`);
+  }
+}
+
+test('parseEnvFile reads a systemd EnvironmentFile: comments, blanks, quotes, empties', () => {
+  const env = parseEnvFile('# comment\n\nA=1\nB="two words"\nC=\'three\'\nD=\n  E = spaced \nnot a line\n');
+  assert.deepEqual(env, { A: '1', B: 'two words', C: 'three', D: '', E: 'spaced' });
+});
+
+test('a configured host reads as present, row by row, with the NAME that satisfied each', () => {
+  const r = sweep({ files: { 'web.env': { env: parseEnvFile(WEB_ENV) }, 'box.env': { env: { DO_API_TOKEN: SECRETS.box } }, 'spaces.env': { env: {} } } });
+  const row = (id) => r.rows.find((x) => x.id === id);
+  assert.equal(row('github-sign-in').state, 'set');
+  assert.deepEqual(row('github-sign-in').satisfiedBy, [`${P}_GITHUB_CLIENT_ID`, `${P}_GITHUB_CLIENT_SECRET`]);
+  assert.equal(row('publish-pat').state, 'set');
+  assert.equal(row('publish-app').state, 'missing', 'the App is absent...');
+  assert.equal(r.groups.publish.satisfied, true, '...but the publish group is satisfied by the PAT');
+  assert.equal(row('discord-bot').state, 'empty', 'a name present with no value is called out, not treated as set');
+  assert.equal(row('digitalocean').state, 'set');
+  assert.equal(row('cloudflare').state, 'missing');
+  assert.deepEqual(r.requiredMissing, [], 'every required row, or its alternative, is present');
+  assert.equal(r.ok, true);
+});
+
+test('THE ONE RULE: no value, and no fragment of one, ever reaches the report or --json', () => {
+  const r = sweep({ files: { 'web.env': { env: parseEnvFile(WEB_ENV) }, 'box.env': { env: { DO_API_TOKEN: SECRETS.box } }, 'spaces.env': { env: {} } } });
+  assertNoValueIn(format(r, { etc: '/etc/example' }));
+  assertNoValueIn(JSON.stringify(r));
+});
+
+test('a missing required credential fails the sweep and is named', () => {
+  const env = parseEnvFile(WEB_ENV);
+  delete env.GITHUB_PUSH_TOKEN;
+  const r = sweep({ files: { 'web.env': { env }, 'box.env': { env: {} }, 'spaces.env': { env: {} } } });
+  assert.equal(r.groups.publish.satisfied, false, 'neither the App nor the PAT is set');
+  assert.ok(r.requiredMissing.includes('publish-app') && r.requiredMissing.includes('publish-pat'));
+  assert.equal(r.ok, false);
+  assert.match(format(r), /REQUIRED and missing: .*publish-app/);
+});
+
+test('the App needs BOTH halves: an id without a key is not a publish credential', () => {
+  const r = sweep({ files: { 'web.env': { env: { GITHUB_APP_ID: '123' } }, 'box.env': { env: {} }, 'spaces.env': { env: {} } } });
+  const app = r.rows.find((x) => x.id === 'publish-app');
+  assert.equal(app.state, 'missing');
+  assert.deepEqual(app.missing, ['GITHUB_APP_PRIVATE_KEY']);
+});
+
+test('a prefixed name also answers to its legacy spelling, the way the server reads it', () => {
+  const env = { CLOUDBONGOS_GITHUB_CLIENT_ID: 'x-id', CLOUDBONGOS_GITHUB_CLIENT_SECRET: 'x-secret' };
+  const r = sweep({ files: { 'web.env': { env }, 'box.env': { env: {} }, 'spaces.env': { env: {} } } });
+  const row = r.rows.find((x) => x.id === 'github-sign-in');
+  if (P === 'CLOUDBONGOS') return; // the legacy spelling IS canonical on such an instance
+  assert.equal(row.state, 'set');
+  assert.deepEqual(row.satisfiedBy, ['CLOUDBONGOS_GITHUB_CLIENT_ID', 'CLOUDBONGOS_GITHUB_CLIENT_SECRET']);
+});
+
+test('the secret-box key counts when it lives in the key file instead of the env', () => {
+  const r = sweep({ files: { 'web.env': { env: {} }, 'box.env': { env: {} }, 'spaces.env': { env: {} } }, keyFileExists: true });
+  assert.equal(r.rows.find((x) => x.id === 'secret-box-key').state, 'set');
+});
+
+test('an unreadable web.env makes the answer UNKNOWN (exit 2), never a clean pass', () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'cred-etc-'));
+  try {
+    const files = readFiles(dir);
+    assert.ok(files['web.env'].error, 'no web.env here');
+    assert.deepEqual(files['spaces.env'], { env: {} }, 'an absent spaces.env only means offsite backup was never set up');
+    const r = spawnSync(process.execPath, [SCRIPT, '--etc', dir], { cwd: ROOT, encoding: 'utf8' });
+    assert.equal(r.status, 2, r.stdout + r.stderr);
+    assert.match(r.stdout, /could not read/);
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test('the CLI, run against a real env dir, reports presence and prints no value', () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'cred-etc-'));
+  try {
+    fs.writeFileSync(path.join(dir, 'web.env'), WEB_ENV);
+    fs.writeFileSync(path.join(dir, 'box.env'), `DO_API_TOKEN=${SECRETS.box}\nCLOUDFLARE_API_TOKEN=\n`);
+    const r = spawnSync(process.execPath, [SCRIPT, '--etc', dir], { cwd: ROOT, encoding: 'utf8' });
+    assert.equal(r.status, 0, r.stdout + r.stderr);
+    assert.match(r.stdout, /✓ github-sign-in/);
+    assert.match(r.stdout, /! cloudflare .*set but EMPTY: CLOUDFLARE_API_TOKEN/);
+    assertNoValueIn(r.stdout + r.stderr);
+    const j = spawnSync(process.execPath, [SCRIPT, '--etc', dir, '--json'], { cwd: ROOT, encoding: 'utf8' });
+    assert.equal(JSON.parse(j.stdout).ok, true);
+    assertNoValueIn(j.stdout + j.stderr);
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test('docs/credentials.md documents every variable the sweep checks', () => {
+  const doc = fs.readFileSync(path.join(ROOT, 'docs', 'credentials.md'), 'utf8');
+  for (const row of CREDENTIALS) {
+    for (const name of row.names) {
+      const shown = row.prefixed ? `<PREFIX>_${name}` : name;
+      assert.ok(doc.includes('`' + shown + '`'), `docs/credentials.md must name \`${shown}\` (row ${row.id})`);
+    }
+  }
+  assert.match(doc, /never a value|No value of any credential/i, 'the page states the one rule');
+});

package/tests/deploy_audit_gate.mjs

@@ -89,13 +89,16 @@ test('the range handed to the auditor is the exact deploy delta, not a window',
   try {
     const gdsDir = path.join(repo.dir, 'node_modules', '@bongos', 'core', 'scripts', 'gds');
     fs.mkdirSync(gdsDir, { recursive: true });
+    // The range rides --range, not an env var (task 1001441): a shell cannot compute
+    // the instance's branded env prefix, and argv needs none.
     fs.writeFileSync(path.join(gdsDir, 'main-audit.js'),
-      'require("fs").writeFileSync("range.txt", process.env.OTB_AUDIT_RANGE || "UNSET");\n');
+      'const a = process.argv; const i = a.indexOf("--range");\n'
+      + 'require("fs").writeFileSync("range.txt", i >= 0 ? a[i + 1] : "UNSET");\n');
     const r = runGate(repo, { OTB_DEPLOY_PREV_SHA: repo.prev });
     assert.equal(r.code, 0, r.out);
     assert.equal(
       fs.readFileSync(path.join(repo.dir, 'range.txt'), 'utf8'), `${repo.prev}..HEAD`,
-      'the auditor must receive <previously-deployed>..HEAD',
+      'the auditor must receive --range <previously-deployed>..HEAD',
     );
   } finally { fs.rmSync(repo.dir, { recursive: true, force: true }); }
 });

package/tests/deploy_page_projects.mjs

@@ -37,7 +37,7 @@ const FLEET = [
   { id: '35', slug: 'unreadable-one', status: 'active', hosting_shape: 'cloud-host' },
 ];
 
-function boot({ controlPlane = preview('1', 'cloudbongos'), controlPlaneStatus = 200, fleet = FLEET, fleetStatus = 200, instanceOver = null, moveTries = 4, postStatus = 200, scope = null } = {}) {
+function boot({ controlPlane = preview('1', 'cloudbongos'), controlPlaneStatus = 200, fleet = FLEET, fleetStatus = 200, instanceOver = null, moveTries = 4, postStatus = 200, scope = null, href = null } = {}) {
   const els = new Map();
   const posts = [];
   const gets = [];
@@ -94,7 +94,7 @@ function boot({ controlPlane = preview('1', 'cloudbongos'), controlPlaneStatus =
     OTB: { escapeHtml: (s) => String(s).replace(/[&<>"]/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;' }[c])), toast(m) { toasts.push(String(m)); } },
     // `search` is what decides which project the page is about. A stub without it is the
     // shape the page has to survive, and the default here keeps that path exercised.
-    location: { assign() {}, search: scope ? `?project=${encodeURIComponent(scope)}` : '' },
+    location: { assign() {}, search: scope ? `?project=${encodeURIComponent(scope)}` : '', ...(href ? { href } : {}) },
   };
   // The page's poll interval, driven rather than slept through. Injecting the REAL
   // setTimeout made every case whose preview never converges sit out the page's full
@@ -583,3 +583,64 @@ test('a queue that is REFUSED leaves no in-flight state to wait on', async () =>
   assert.ok(b.toasts.some((t) => /currently running/i.test(t)), 'and the refusal is reported');
   assert.match(b.panel(), /id="dp-confirm-32"/, 'the button comes back so it can be retried');
 });
+
+// ---- landed, but GitHub was not updated (task 1004065) ----------------------------
+//
+// The hub pushes a hosted project's pin to its GitHub repo after the upgrade. When it
+// cannot, the move is still DONE (the site runs the new core) but the page must not
+// read "and the box confirmed it" as though everything was saved — the box and the
+// repo have split, and changes pushed to GitHub can stop reaching the live site.
+
+const landedWith = (warning) => () => ({
+  served_version: '1.19.871', recommended_version: '1.19.871', behind: false, open_intent: null,
+  last_move: { target_version: '1.19.871', state: 'done', at: new Date(Date.now() - 60 * 1000).toISOString(), error: null, warning },
+});
+
+test('a move that landed but did NOT reach GitHub says so, instead of a clean confirmation', async () => {
+  const b = boot({ scope: 'mercury', instanceOver: landedWith({ code: 'no_access', text: 'The hub had no permission to write to the project’s GitHub repository.' }) });
+  await b.settle();
+  const html = b.panel();
+  assert.match(html, /Now running core 1\.19\.871/, 'the upgrade itself is still stated — it worked');
+  assert.match(html, /GitHub was not updated/i, 'and the half that did not happen is the headline beside it');
+  assert.match(html, /no permission to write/, 'with the runner’s reason in plain words');
+  assert.match(html, /dp-settled--warn/, 'a warning mark — not the success mark, not the failure one');
+  assert.doesNotMatch(html, /dp-settled--ok/);
+  assert.doesNotMatch(html, /dp-settled--failed/);
+  assert.doesNotMatch(html, /did not land/i, 'it DID land');
+});
+
+test('when the fix is reconnecting GitHub, the page links straight to it and comes back here', async () => {
+  for (const code of ['no_access', 'refused']) {
+    const b = boot({ scope: 'mercury', instanceOver: landedWith({ code, text: 'x' }) });
+    await b.settle();
+    const html = b.panel();
+    assert.match(html, /href="\/api\/bongos\/auth\/web\/start\?repos=1&amp;return=%2Fdeploy%3Fproject%3Dmercury"/,
+      `${code}: the repo-access sign-in, returning to this project's deploy page — got ${html}`);
+    assert.match(html, /within the hour/i, `${code}: and it says the access is short-lived, rather than promising a fix`);
+  }
+});
+
+test('when reconnecting cannot help, no reconnect link is offered', async () => {
+  for (const code of ['behind', 'no_repo', 'failed', 'no_branch']) {
+    const b = boot({ scope: 'mercury', instanceOver: landedWith({ code, text: 'x' }) });
+    await b.settle();
+    assert.doesNotMatch(b.panel(), /auth\/web\/start/, `${code}: a sign-in does not fix this`);
+  }
+});
+
+test('a clean move still reads as the plain confirmation', async () => {
+  const b = boot({ scope: 'mercury', instanceOver: landedWith(null) });
+  await b.settle();
+  const html = b.panel();
+  assert.match(html, /dp-settled--ok/);
+  assert.doesNotMatch(html, /GitHub was not updated/i);
+});
+
+test('the reconnect link returns to the page\u2019s full https address when there is one', async () => {
+  // A relative return resolves against the sign-in callback's host, which is not the
+  // hall's. The absolute address is admitted by the same allowlist and lands back here.
+  const here = 'https://builders.example.com/deploy?project=mercury';
+  const b = boot({ scope: 'mercury', href: here, instanceOver: landedWith({ code: 'no_access', text: 'x' }) });
+  await b.settle();
+  assert.ok(b.panel().includes(`return=${encodeURIComponent(here)}`), b.panel());
+});

package/tests/dev_lib.mjs

@@ -86,7 +86,8 @@ t('resolveRunParams: port from branding, db from repo dir, TCP localhost, gdsOnl
     'config/branding.neutral.json': NEUTRAL,
     'config/modules.json': JSON.stringify({ modules: { game: false } }),
   });
-  const p = lib.resolveRunParams({ instanceRoot: '/Users/x/test4', coreRoot: '/core', f, env: {}, userInfo: () => ({ username: 'lars' }), argv: [] });
+  // platform pinned: on Windows the default role is `postgres` (tests/dev_windows.mjs).
+  const p = lib.resolveRunParams({ instanceRoot: '/Users/x/test4', coreRoot: '/core', f, env: {}, userInfo: () => ({ username: 'lars' }), argv: [], platform: 'darwin' });
   assert.equal(p.port, 3006);
   assert.equal(p.dbName, 'test4');
   assert.equal(p.pgHost, 'localhost');   // NOT the /var/run/postgresql linux socket