@bongos/core 1.19.1081 → 1.20.1

package/tests/projects_hub_render_connect.mjs

@@ -0,0 +1,295 @@
+// tests/projects_hub_render_connect.mjs — Connect Render from an existing project's page,
+// EXECUTED (task 1004184, ADR 0345).
+//
+// A project whose app has no platform yet (made before the wizard's app step, or whose
+// owner chose "Decide later") gets Connect Render on its "Where its app runs" card. It is
+// the wizard's own flow — its markup cloned, its logic renderConnect() — so this slices the
+// page's region and the shared flow out of projects.html by their sentinels and runs them
+// in `vm` over a small fake DOM built from the wizard's real Render markup.
+//
+// The load-bearing assertions:
+//   • it is offered only on the owner's own "no platform" answer, and only for a project
+//     the server would take it for; a project that never connects is left as it was
+//   • it is the wizard's flow, not a second one: the same ids, prefixed, and the same checks
+//   • the key is sent once, in a POST body to THIS project, and forgotten at once — on a
+//     refusal too — and the card then shows the app's own progress
+//   • moving to another project forgets every answer
+//
+// Run:  node --test --test-reporter=tap tests/projects_hub_render_connect.mjs
+
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.join(path.dirname(fileURLToPath(import.meta.url)), '..');
+const HUB = fs.readFileSync(path.join(ROOT, 'modules', 'public-landing', 'public', 'projects.html'), 'utf8').replace(/\r\n/g, '\n');
+
+function fence(start, end) {
+  const from = HUB.indexOf(start), to = HUB.indexOf(end, from);
+  assert.ok(from > -1 && to > from, `fenced: ${start.trim()}`);
+  return HUB.slice(from, to);
+}
+const CONNECT = fence('  /* ── connecting Render (task 1004352', '  /* end of connecting Render */');
+const PAGE = fence('  var stopAppWatch = null;', "  /* end of Connect Render from the project's page */");
+const APPEL = (HUB.match(/function appEl\(tag, cls, text\) \{[\s\S]*?\n  \}/) || [''])[0];
+assert.ok(APPEL, 'the page\'s own appEl() is lifted');
+const SETUP = (HUB.match(/<div class="renderSetup" id="renderSetup" hidden>[\s\S]*?<div class="hint" id="h-render" role="status">&nbsp;<\/div>/) || [''])[0];
+assert.ok(SETUP, 'the wizard\'s Render markup is found');
+const CARD = (HUB.match(/<div class="card mSec" id="mAppCard" hidden>[\s\S]*?\n      <\/div>\n/) || [''])[0];
+
+const KEY = 'rnd_abcdefghijklmnopqrstuvwx';
+const TEA_A = 'tea-aaaaaaaa1111';
+const LOOKUP = '/api/bongos/provisioning/render/lookup';
+const RENDER = '/api/bongos/provisioning/instances/7/render';
+const SERVICES = { services: [{ id: 'srv-aaaaaaaa1111', name: 'shop', repo: 'https://github.com/example-owner/shop', url: null }] };
+const INST = { id: 7, slug: 'shop', status: 'active', target_ref: 'example-owner/shop' };
+const flush = async () => { for (let i = 0; i < 8; i++) await new Promise((r) => setTimeout(r, 0)); };
+
+// ── a fake DOM: what the region and the flow use ──
+const escText = (x) => String(x).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
+class Text { constructor(t) { this.text = String(t); } html() { return escText(this.text); } get textContent() { return this.text; } }
+class El {
+  constructor(tag, id) { this.tagName = tag; this.id = id || ''; this.children = []; this.attrs = {}; this.listeners = {};
+    this.hidden = false; this.value = ''; this.className = ''; this.checked = false; this.disabled = false; this.type = ''; this.name = ''; this.focused = false; }
+  appendChild(c) { this.children.push(c); return c; }
+  insertBefore(c, ref) { const i = this.children.indexOf(ref); if (i < 0) this.children.push(c); else this.children.splice(i, 0, c); return c; }
+  get firstChild() { return this.children[0] || null; }
+  setAttribute(k, v) { this.attrs[k] = String(v); }
+  getAttribute(k) { return k in this.attrs ? this.attrs[k] : null; }
+  set textContent(v) { this.children = v === '' || v == null ? [] : [new Text(v)]; }
+  get textContent() { return this.children.map((c) => c.textContent).join(''); }
+  addEventListener(ev, fn) { (this.listeners[ev] = this.listeners[ev] || []).push(fn); }
+  fire(ev, event) { (this.listeners[ev] || []).forEach((fn) => fn.call(this, event || { target: this })); }
+  focus() { this.focused = true; }
+  all() { return [this, ...this.children.filter((c) => c instanceof El).flatMap((c) => c.all())]; }
+  querySelectorAll(sel) {
+    const kids = this.all().slice(1);
+    if (sel === '[id]') return kids.filter((e) => e.id);
+    if (sel === '[aria-describedby]') return kids.filter((e) => e.getAttribute('aria-describedby') != null);
+    throw new Error('unexpected selector ' + sel);
+  }
+  cloneNode() {
+    const c = new El(this.tagName, this.id);
+    Object.assign(c.attrs, this.attrs); c.className = this.className; c.hidden = this.hidden; c.value = this.value; c.type = this.type;
+    this.children.forEach((k) => c.appendChild(k instanceof El ? k.cloneNode(true) : new Text(k.text)));
+    return c;
+  }
+  html() {
+    const a = [this.id ? ` id="${this.id}"` : '', this.className ? ` class="${this.className}"` : '', this.type ? ` type="${this.type}"` : '', this.name ? ` name="${this.name}"` : '',
+      ...Object.entries(this.attrs).map(([k, v]) => ` ${k}="${v}"`), this.checked ? ' checked' : '', this.disabled ? ' disabled' : ''].join('');
+    return `<${this.tagName}${a}>${this.children.map((c) => c.html()).join('')}</${this.tagName}>`;
+  }
+}
+
+// The wizard's #renderSetup, one node per id in the REAL markup (flat: the flow only ever
+// finds its elements by id), so a field added to the step is here the day it lands.
+function wizardSetup() {
+  const root = new El('div', 'renderSetup');
+  root.className = 'renderSetup'; root.hidden = true;
+  for (const m of SETUP.matchAll(/<(\w+)[^>]*\sid="([^"]+)"([^>]*)>/g)) {
+    if (m[2] === 'renderSetup') continue;
+    const e = new El(m[1], m[2]);
+    const d = (m[0].match(/aria-describedby="([^"]+)"/) || [])[1];
+    if (d) e.setAttribute('aria-describedby', d);
+    if (m[1] === 'input') e.type = (m[0].match(/type="([^"]+)"/) || [])[1] || 'text';
+    root.appendChild(e);
+  }
+  return root;
+}
+
+function load({ answers = {} } = {}) {
+  const roots = [wizardSetup()];
+  const card = new El('div', 'mAppCard'); card.hidden = true;
+  ['mApp', 'mAppConnect', 'mAppConnectOpen', 'mAppConnectForm', 'mAppConnectGo', 'mAppConnectCancel'].forEach((id) => {
+    const e = new El(id.endsWith('Open') || id.endsWith('Go') || id.endsWith('Cancel') ? 'button' : 'div', id);
+    if (id === 'mAppConnect' || id === 'mAppConnectForm') e.hidden = true;
+    card.appendChild(e);
+  });
+  roots.push(card);
+  const byId = (id) => { for (const r of roots) { const e = r.all().find((x) => x.id === id); if (e) return e; } return null; };
+  const document = { getElementById: byId, createElement: (t) => new El(t), createTextNode: (t) => new Text(t) };
+  const calls = [], watches = [];
+  const fetch = async (url, init) => {
+    const body = init && init.body ? JSON.parse(init.body) : null;
+    calls.push({ url, method: (init && init.method) || 'GET', body });
+    const k = url + (body && body.owner_id && url === LOOKUP ? '#' + body.owner_id : '');
+    const a = answers[k] !== undefined ? answers[k] : answers[url];
+    if (a === undefined) return { ok: false, status: 404, json: async () => ({ error: { message: 'not found' } }) };
+    if (a.status) return { ok: false, status: a.status, json: async () => ({ error: { message: a.message } }) };
+    return { ok: true, status: 200, json: async () => a };
+  };
+  // the status watch lives in the task-1004353 block; record it, and let a test drive its offer
+  const watchApp = (id, box, alive, everyMs, cardEl, offer) => { watches.push({ id, box, alive, everyMs, card: cardEl, offer }); return () => {}; };
+  const ctx = { document, fetch, watchApp, API: '/api/bongos', manageId: 7, JSON, String, Number, Object, encodeURIComponent };
+  ctx.$ = byId;
+  vm.createContext(ctx);
+  vm.runInContext(APPEL + '\n' + CONNECT + '\n' + PAGE + '\nthis.api = { loadAppStatus, offerAppConnect };', ctx);
+  const q = (id) => byId('m-' + id);
+  // What the watch does with an answer: show the card when the status view or the offer has something.
+  const paint = (data) => { const w = watches[watches.length - 1]; const offered = w.offer(data); card.hidden = !(data && data.app) && !offered; return offered; };
+  return { ...ctx.api, ctx, card, byId, q, calls, watches, paint, wizard: roots[0],
+    open: () => byId('mAppConnectOpen').fire('click'),
+    typeKey: (v) => { q('f-renderKey').value = v; q('f-renderKey').fire('input'); },
+    check: async () => { q('renderCheck').fire('click'); await flush(); },
+    pickWorkspace: async (i) => { q('renderWsList').fire('change', { target: { getAttribute: () => String(i) } }); await flush(); },
+    pickNew: () => q('renderSvcList').fire('change', { target: { name: 'm-renderSvc', value: 'new', disabled: false } }),
+    go: async () => { byId('mAppConnectGo').fire('click'); await flush(); },
+  };
+}
+const NONE = { ok: true, app: null, env_vars: [], values_held: false };
+const ANSWERS = { [LOOKUP]: { workspaces: [{ id: TEA_A, name: 'Mine', type: 'team' }] }, [LOOKUP + '#' + TEA_A]: SERVICES };
+
+async function readyToSend(w) {
+  w.loadAppStatus(7, INST); w.paint(NONE); w.open();
+  w.typeKey(KEY); await w.check(); await w.pickWorkspace(0); w.pickNew();
+  w.q('f-renderStart').value = 'npm start';
+  w.q('renderNew').fire('input', { target: w.q('f-renderStart') });
+}
+
+// ── the markup and the one-flow rule ────────────────────────────────────────
+
+test('the card carries Connect Render, and the page builds nodes, never an HTML string', () => {
+  assert.ok(CARD, '#mAppCard exists');
+  assert.match(CARD, /<div id="mApp"><\/div>\n\s*<div class="appConnect" id="mAppConnect" hidden>/, 'under the status, hidden until offered');
+  assert.match(CARD, /<button type="button" class="btn small" id="mAppConnectOpen">Connect Render<\/button>/);
+  assert.match(CARD, /We keep hosting this project’s Builders' hall either way/, 'it says the hall stays with us (ADR 0345 D1)');
+  for (const [name, src] of [['the page region', PAGE], ['the shared flow', CONNECT]]) {
+    assert.doesNotMatch(src, /innerHTML|insertAdjacentHTML|outerHTML|document\.write/, `${name} builds nodes`);
+  }
+});
+
+test('the wizard and the page run the same flow — renderConnect() is called from both, and defined once', () => {
+  assert.equal((HUB.match(/function renderConnect\(/g) || []).length, 1);
+  assert.match(HUB, /var rc = renderConnect\(\$, state, \{/, 'the wizard');
+  assert.match(PAGE, /appConnect = renderConnect\(appConnectQ, appConnectSt, \{/, 'the project page');
+  assert.match(PAGE, /\$\('renderSetup'\)\.cloneNode\(true\)/, 'the page borrows the wizard\'s markup, not a copy of it');
+  assert.equal((HUB.match(/function renderLookup\(|function paintWorkspaces\(\) \{\n      var list = renderWorkspaces/g) || []).length, 0, 'the wizard\'s old private copy is gone');
+});
+
+test('the added styles keep links on the link ink', () => {
+  const css = (HUB.match(/\/\* the same step on a project's page \(task 1004184\)[\s\S]*?\n(?!\.appConnect)/) || [''])[0];
+  assert.ok(css.includes('.appConnect'), 'the block is found');
+  assert.doesNotMatch(css, /--accent-deep/);
+  assert.match(HUB, /\.renderWhy a\{[^}]*color:var\(--link-ink\)/, 'the key-help link the page borrows is on --link-ink');
+});
+
+// ── when it is offered ──────────────────────────────────────────────────────
+
+test('offered on the owner\'s own "no platform" answer, for a project the server would take', () => {
+  const w = load();
+  w.loadAppStatus(7, INST);
+  assert.equal(w.watches.length, 1);
+  assert.equal(w.watches[0].card, w.byId('mAppCard'), 'the watch is handed the card');
+  assert.equal(w.paint(NONE), true);
+  assert.equal(w.byId('mAppConnect').hidden, false);
+  assert.equal(w.card.hidden, false);
+  assert.equal(w.byId('mAppConnectForm').hidden, true, 'the form waits for the owner to open it');
+  assert.equal(w.calls.length, 0, 'nothing is asked of Render until then');
+});
+
+test('not offered — and the card stays hidden — when the project could not take it or the answer is not the owner\'s', () => {
+  for (const [why, inst, data] of [
+    ['someone else\'s project: the owner-only read answered nothing', INST, null],
+    ['a project already on Render', INST, { ok: true, app: { platform: 'render', state: 'live', stage: 'live' }, env_vars: [] }],
+    ['a removed project', { ...INST, status: 'torn_down' }, NONE],
+    ['a project being removed', { ...INST, status: 'tearing_down' }, NONE],
+    ['no repository to build', { ...INST, target_ref: null }, NONE],
+  ]) {
+    const w = load();
+    w.loadAppStatus(7, inst);
+    assert.equal(w.paint(data), false, why);
+    assert.equal(w.byId('mAppConnect').hidden, true, why);
+    if (!(data && data.app)) assert.equal(w.card.hidden, true, why + ': the card hides');
+  }
+});
+
+// ── the flow ────────────────────────────────────────────────────────────────
+
+test('opening it borrows the wizard\'s step under prefixed ids, and leaves the wizard\'s own alone', () => {
+  const w = load();
+  w.loadAppStatus(7, INST); w.paint(NONE);
+  w.open();
+  const copy = w.byId('m-renderSetup');
+  assert.ok(copy, 'the step is cloned in');
+  assert.equal(w.byId('mAppConnectForm').firstChild, copy, 'above the Connect / Cancel buttons');
+  assert.equal(copy.hidden, false);
+  assert.equal(w.byId('mAppConnectForm').hidden, false);
+  assert.equal(w.byId('mAppConnectOpen').hidden, true);
+  assert.equal(w.q('f-renderKey').focused, true, 'focus lands on the key');
+  assert.equal(w.q('f-renderKey').getAttribute('aria-describedby'), 'm-h-renderKey', 'its description points at its own hint');
+  assert.ok(w.wizard.all().every((e) => !e.id.startsWith('m-')), 'the wizard keeps its ids');
+  w.byId('mAppConnectCancel').fire('click'); w.open();
+  assert.equal(w.byId('mAppConnectForm').children.filter((c) => c.id === 'm-renderSetup').length, 1, 'cloned once, however often it is opened');
+});
+
+test('the same checks as the wizard, with the page\'s own words for a missing key', async () => {
+  const w = load({ answers: ANSWERS });
+  w.loadAppStatus(7, INST); w.paint(NONE); w.open();
+  await w.go();
+  assert.match(w.q('h-render').textContent, /^Check your Render key first\.$/, 'no "Decide later" here — there is no such choice on this card');
+  w.typeKey('ghp_notrender'); await w.check();
+  assert.match(w.q('h-renderKey').textContent, /starts with “rnd_”/);
+  assert.equal(w.calls.length, 0, 'a malformed key never leaves the page');
+  w.typeKey(KEY); await w.check(); await w.pickWorkspace(0);
+  const list = w.q('renderSvcList').html();
+  assert.match(list, /name="m-renderSvc" value="new"/, 'its own radio group, so it never joins the wizard\'s');
+  assert.match(list, /Render builds it from <code>example-owner\/shop<\/code>/, 'the project\'s own repository');
+  assert.match(list, /data-i="0">[\s\S]*Link shop/, 'its own app can be linked');
+  await w.go();
+  assert.match(w.q('h-render').textContent, /new app or link/);
+  assert.equal(w.calls.filter((c) => c.url === RENDER).length, 0);
+});
+
+test('Connect sends the key once, to this project, forgets it, and the card shows the app\'s progress', async () => {
+  const w = load({ answers: { ...ANSWERS, [RENDER]: { ok: true, queued: true } } });
+  await readyToSend(w);
+  await w.go();
+  const sent = w.calls.filter((c) => c.url === RENDER);
+  assert.equal(sent.length, 1);
+  assert.equal(sent[0].method, 'POST');
+  assert.deepEqual(sent[0].body, { key: KEY, owner_id: TEA_A, mode: 'greenfield', runtime: 'node', start_command: 'npm start', web_plan: 'starter', database: false });
+  for (const c of w.calls) assert.ok(!c.url.includes(KEY), 'no URL carries the key');
+  assert.equal(w.q('f-renderKey').value, '', 'the field is emptied');
+  assert.equal(w.byId('mAppConnectForm').hidden, true, 'the form closes');
+  assert.equal(w.watches.length, 2, 'the status is read again');
+  assert.equal(String(w.watches[1].id), '7');
+  assert.equal(w.paint({ ok: true, app: { platform: 'render', state: 'provisioning', stage: 'creating', waiting: true }, env_vars: [] }), false, 'and once the app has a platform, the offer steps aside');
+  assert.equal(w.byId('mAppConnect').hidden, true);
+  assert.equal(w.card.hidden, false, 'for the progress panel');
+  await w.go();
+  assert.equal(w.calls.filter((c) => c.url === RENDER).length, 1, 'a second press has no key to send');
+});
+
+test('a refusal says so in the server\'s words, and the key is gone all the same', async () => {
+  const w = load({ answers: { ...ANSWERS, [RENDER]: { status: 409, message: 'A \'provision\' run is running for this project, so your key was not kept. Try again once it has finished.' } } });
+  await readyToSend(w);
+  await w.go();
+  assert.match(w.q('h-render').textContent, /A 'provision' run is running for this project/);
+  assert.match(w.q('h-render').className, /err/);
+  assert.equal(w.q('f-renderKey').value, '');
+  assert.equal(w.byId('mAppConnectGo').disabled, false, 'the owner can try again');
+  assert.equal(w.watches.length, 1, 'no progress to watch');
+  await w.go();
+  assert.match(w.q('h-render').textContent, /Check your Render key first/, 'a retry starts with the key');
+});
+
+test('Cancel forgets the key; a reload of the same project keeps the open form; another project forgets every answer', async () => {
+  const w = load({ answers: ANSWERS });
+  w.loadAppStatus(7, INST); w.paint(NONE); w.open();
+  w.typeKey(KEY); await w.check(); await w.pickWorkspace(0);
+  w.loadAppStatus(7, INST); w.paint(NONE);
+  assert.equal(w.byId('mAppConnectForm').hidden, false, 'the page\'s reload of this project leaves the form open');
+  assert.equal(w.q('f-renderKey').value, KEY, 'with what the owner typed');
+  w.byId('mAppConnectCancel').fire('click');
+  assert.equal(w.q('f-renderKey').value, '');
+  assert.equal(w.byId('mAppConnectForm').hidden, true);
+  assert.equal(w.byId('mAppConnectOpen').hidden, false);
+  w.ctx.manageId = 8;
+  w.loadAppStatus(8, { ...INST, id: 8, target_ref: 'example-owner/other' });
+  w.paint(NONE); w.open();
+  assert.equal(w.q('renderWs').hidden, true, 'nothing Render said about project 7 is shown for project 8');
+  assert.match(w.q('h-renderKey').textContent, /^\s*$/, 'and it is not asked to re-enter a key it never gave');
+});

package/tests/provision_render.mjs

@@ -9,8 +9,10 @@
 //     on a mismatched workspace, on a Render error and on a decrypt failure
 //   • the ownerId guard refuses a mismatched response, and the run stops there — nothing
 //     is created after it
-//   • ADOPT makes no write call to Render at all; GREENFIELD creates the database, then
-//     the service, sets the SVC_URL-dependent env vars, then deploys — in that order
+//   • ADOPT makes no write call to Render at all, and links only a service that builds
+//     THIS project's repository; GREENFIELD creates the database only when asked for, then
+//     the app's service — built from the project's own repository the way its owner said,
+//     never the Bongos core (task 1004350, ADR 0345)
 //   • the plan is read from the project's row, not a constant
 //   • a failure is TERMINAL: the runner retires it instead of re-queuing it, because the
 //     key is gone and the owner retries by entering it again
@@ -47,7 +49,7 @@ function fakeRender(over = {}) {
     'GET /postgres/dpg-new/connection-info': { internalConnectionString: 'postgres://internal' },
     'POST /services': { deployId: 'dep-1', service: { id: 'srv-new', ownerId: OURS, serviceDetails: { url: SVC_URL } } },
     'GET /services/srv-new': { id: 'srv-new', ownerId: OURS, serviceDetails: { url: SVC_URL } },
-    'GET /services/srv-old': { id: 'srv-old', ownerId: OURS, serviceDetails: { url: 'https://old.onrender.com' } },
+    'GET /services/srv-old': { id: 'srv-old', ownerId: OURS, repo: 'https://github.com/Example-Owner/demo', serviceDetails: { url: 'https://old.onrender.com' } },
     'POST /services/srv-new/deploys': { id: 'dep-2' },
     ...over,
   };
@@ -81,7 +83,7 @@ function harness({ host = {}, intent = {}, render = {}, decryptThrows = false }
     renderApiFactory: ({ token, ownerId }) => new RenderApi({ token, ownerId, dryRun: false, fetchImpl: r.fetchImpl }),
   };
   const inst = { id: 18, slug: 'demo', owner_builder_id: 7, target_ref: 'example-owner/demo', status: 'active',
-    app_host: { platform: 'render', mode: 'greenfield', ownerId: OURS, ...host } };
+    app_host: { platform: 'render', mode: 'greenfield', ownerId: OURS, runtime: 'node', buildCommand: 'npm ci', startCommand: 'npm start', database: true, ...host } };
   const it = { id: 44, action: 'render-standup', borrowed_key_enc: 'v1.enc', created_at: new Date().toISOString(), ...intent };
   const cleared = () => writes.filter((w) => /UPDATE provisioning_intents SET borrowed_key_enc = NULL WHERE id = \$1/.test(w.sql) && w.params[0] === 44).length;
   const appHost = () => writes.filter((w) => /SET app_host/.test(w.sql)).map((w) => JSON.parse(w.params[1]));
@@ -91,45 +93,62 @@ function harness({ host = {}, intent = {}, render = {}, decryptThrows = false }
 
 const writesTo = (calls) => calls.filter((c) => c.method !== 'GET');
 
-console.log('greenfield:');
-await ta('creates the database, then the service, sets the origins, then deploys — and clears the key', async () => {
+console.log("greenfield — the owner's app:");
+await ta("with a database: the database, then the app's service — and the key cleared", async () => {
   const h = harness();
   const out = await h.run();
   assert.equal(out.ok, true, out.error);
-  assert.deepEqual(writesTo(h.r.calls).map((c) => c.method + ' ' + c.path.replace(/env-vars\/.*/, 'env-vars/*')), [
-    'POST /postgres', 'POST /services',
-    'PUT /services/srv-new/env-vars/*', 'PUT /services/srv-new/env-vars/*', 'PUT /services/srv-new/env-vars/*', 'PUT /services/srv-new/env-vars/*',
-    'POST /services/srv-new/deploys',
-  ]);
-  const origins = h.r.calls.filter((c) => c.method === 'PUT').map((c) => [c.path.split('/').pop(), c.body.value]);
-  assert.deepEqual(origins, [['BONGOS_PUBLIC_ORIGIN', SVC_URL], ['BONGOS_BUILDERS_ORIGIN', SVC_URL], ['BONGOS_STATUS_ORIGIN', SVC_URL], ['BONGOS_OAUTH_ORIGIN', SVC_URL]]);
+  assert.deepEqual(writesTo(h.r.calls).map((c) => c.method + ' ' + c.path), ['POST /postgres', 'POST /services'],
+    'no env var PUTs and no extra deploy: Render deploys a new service on its own');
   assert.equal(h.cleared(), 1, 'the key column is cleared');
   const host = h.lastHost();
-  assert.deepEqual([host.postgresId, host.serviceId, host.state, host.serviceUrl, host.error], ['dpg-new', 'srv-new', 'deploying', SVC_URL, null], 'the row records what was created');
+  assert.deepEqual([host.postgresId, host.serviceId, host.state, host.serviceUrl, host.webPlan, host.error], ['dpg-new', 'srv-new', 'deploying', SVC_URL, 'starter', null], 'the row records the service, its URL and the plan');
 });
 
-await ta('the service is the pilot\'s: node runtime, explicit start + migrate, HOST, the database SVC_URL, a fresh secret, the owner seated', async () => {
+await ta('without a database: no Postgres is created and the app gets no DATABASE_URL', async () => {
+  const h = harness({ host: { database: false } });
+  const out = await h.run();
+  assert.equal(out.ok, true, out.error);
+  assert.ok(!h.r.calls.some((c) => c.path.startsWith('/postgres')), 'nothing about a database is called');
+  const svc = h.r.calls.find((c) => c.method === 'POST' && c.path === '/services').body;
+  assert.deepEqual(svc.envVars, []);
+  assert.equal(h.lastHost().postgresId, undefined);
+});
+
+await ta("the service is the owner's app: their repository, runtime and commands — not the Bongos core", async () => {
   const h = harness();
   await h.run();
   const svc = h.r.calls.find((c) => c.method === 'POST' && c.path === '/services').body;
   assert.equal(svc.ownerId, OURS);
   assert.equal(svc.repo, 'https://github.com/example-owner/demo');
   assert.equal(svc.serviceDetails.runtime, 'node');
-  assert.match(svc.serviceDetails.envSpecificDetails.startCommand, /platform-server\.js$/);
-  assert.match(svc.serviceDetails.envSpecificDetails.preDeployCommand, /migrate\.sh$/);
-  const env = Object.fromEntries(svc.envVars.map((v) => [v.key, v.value]));
-  assert.equal(env.HOST, '0.0.0.0');
-  assert.equal(env.DATABASE_URL, 'postgres://internal');
-  assert.equal(env.PGDATABASE, 'postgres://internal');
-  assert.match(env.BUILDER_SECRET_KEY, /^[0-9a-f]{64}$/);
-  assert.equal(env.BONGOS_FIRST_ADMIN, 'owner-login');
-  assert.ok(!('PORT' in env), 'Render injects PORT');
+  assert.deepEqual(svc.serviceDetails.envSpecificDetails, { buildCommand: 'npm ci', startCommand: 'npm start' });
+  const src = JSON.stringify(svc);
+  assert.doesNotMatch(src, /bongos|platform-server|migrate[.]sh|FIRST_ADMIN|BUILDER_SECRET_KEY|_ORIGIN/i, 'nothing of the hall rides along');
+  assert.deepEqual(svc.envVars, [{ key: 'DATABASE_URL', value: 'postgres://internal' }], 'the only value the platform sets');
   const stored = JSON.stringify(h.writes.map((w) => w.params));
-  assert.ok(!stored.includes(env.BUILDER_SECRET_KEY) && !stored.includes('postgres://internal') && !stored.includes('rnd_borrowed'),
-    'no env var value and no key is ever written to our database');
+  assert.ok(!stored.includes('postgres://internal') && !stored.includes('rnd_borrowed'), 'no env var value and no key is ever written to our database');
+});
+
+await ta("docker builds the repository's own Dockerfile, with no commands", async () => {
+  const h = harness({ host: { runtime: 'docker', buildCommand: undefined, startCommand: undefined } });
+  const out = await h.run();
+  assert.equal(out.ok, true, out.error);
+  const svc = h.r.calls.find((c) => c.method === 'POST' && c.path === '/services').body;
+  assert.equal(svc.serviceDetails.runtime, 'docker');
+  assert.deepEqual(svc.serviceDetails.envSpecificDetails, {});
 });
 
-await ta('the plan is the project\'s own setting, not a constant', async () => {
+await ta('a native runtime with no start command is refused before anything is created', async () => {
+  const h = harness({ host: { startCommand: undefined } });
+  const out = await h.run();
+  assert.equal(out.ok, false);
+  assert.match(out.error, /start command/);
+  assert.deepEqual(writesTo(h.r.calls), []);
+  assert.equal(h.cleared(), 1);
+});
+
+await ta("the plan is the project's own setting, not a constant", async () => {
   const h = harness({ host: { webPlan: 'standard', dbPlan: 'basic_1gb', region: 'frankfurt' } });
   await h.run();
   const pg = h.r.calls.find((c) => c.path === '/postgres').body;
@@ -147,7 +166,7 @@ await ta('a retry resumes onto what an earlier run created — no second databas
   const h = harness({ host: { postgresId: 'dpg-new', serviceId: 'srv-new' } });
   const out = await h.run();
   assert.equal(out.ok, true, out.error);
-  assert.ok(!h.r.calls.some((c) => c.method === 'POST' && (c.path === '/postgres' || c.path === '/services')));
+  assert.deepEqual(writesTo(h.r.calls), []);
 });
 
 console.log('\nadopt:');
@@ -160,6 +179,15 @@ await ta('links an existing service and makes NO write call to Render', async ()
   assert.equal(h.lastHost().serviceUrl, 'https://old.onrender.com');
   assert.equal(h.cleared(), 1);
 });
+await ta('a service that builds a DIFFERENT repository is refused — its URL would pose as this app', async () => {
+  const h = harness({ host: { mode: 'adopt', serviceId: 'srv-old' }, render: { 'GET /services/srv-old': { id: 'srv-old', ownerId: OURS, repo: 'https://github.com/example-owner/other-app' } } });
+  const out = await h.run();
+  assert.equal(out.ok, false);
+  assert.ok(out.error.includes('other-app, not example-owner/demo'), out.error);
+  assert.deepEqual(writesTo(h.r.calls), []);
+  assert.equal(h.lastHost().state, 'failed');
+  assert.equal(h.cleared(), 1);
+});
 await ta('adopting a service from another workspace is refused, and the key still cleared', async () => {
   const h = harness({ host: { mode: 'adopt', serviceId: 'srv-old' }, render: { 'GET /services/srv-old': { id: 'srv-old', ownerId: THEIRS } } });
   const out = await h.run();
@@ -249,6 +277,71 @@ await ta('a failure is retired on its FIRST attempt, never re-queued', async ()
   assert.match(d.resolved[0].err, /cannot reach workspace/);
 });
 
+console.log('\nthe wizard path — the app straight after the project, in the same run (task 1004352):');
+const { afterProvision } = require('../scripts/gds/provision-render.js');
+function afterHarness({ keyOnRow = 'v1.enc', host = {} } = {}) {
+  const h = harness({ host });
+  const base = h.deps.db.query;
+  h.deps.db = { query: async (sql, params) => (/SELECT borrowed_key_enc FROM provisioning_intents/.test(sql) ? { rows: [{ borrowed_key_enc: keyOnRow }] } : base(sql, params)) };
+  h.deps.provisioning = { getInstanceById: async () => ({ ...h.inst }) };
+  return h;
+}
+await ta('the project is up and a key rode the run → the app is set up, the key cleared, the run a success', async () => {
+  const h = afterHarness();
+  const out = await afterProvision(h.inst, h.deps, { id: 44, created_at: new Date().toISOString() }, { ok: true, port: 3100 });
+  assert.deepEqual(out, { ok: true, port: 3100 });
+  assert.ok(h.r.calls.some((c) => c.method === 'POST' && c.path === '/services'));
+  assert.equal(h.cleared(), 1);
+});
+await ta('the key is re-read from the row — one attached after the run was claimed is still spent', async () => {
+  const h = afterHarness();
+  await afterProvision(h.inst, h.deps, { id: 44, created_at: new Date().toISOString(), borrowed_key_enc: null }, { ok: true });
+  assert.ok(h.r.calls.length > 0);
+  assert.equal(h.cleared(), 1);
+});
+await ta('the app fails but the project is up → the run stays a success, with a note, and the key cleared', async () => {
+  const h = afterHarness();
+  h.r.calls.length = 0;
+  const hh = afterHarness({ host: { ownerId: 'tea-unreachable1' } });
+  const out = await afterProvision(hh.inst, hh.deps, { id: 44, created_at: new Date().toISOString() }, { ok: true });
+  assert.equal(out.ok, true);
+  assert.match(out.doneNote, /not set up on Render: this Render key cannot reach workspace/);
+  assert.equal(hh.lastHost().state, 'failed');
+  assert.equal(hh.cleared(), 1);
+});
+await ta('the project failed → Render is never called, the key cleared, the app marked failed', async () => {
+  const h = afterHarness();
+  const out = await afterProvision(h.inst, h.deps, { id: 44 }, { ok: false, error: 'DNS preflight failed' });
+  assert.deepEqual(out, { ok: false, error: 'DNS preflight failed' }, 'the provision result is passed through, so its retry rules are unchanged');
+  assert.equal(h.r.calls.length, 0);
+  assert.equal(h.cleared(), 1, 'a provision retry never carries a key into a later run');
+  assert.match(h.lastHost().error, /connect Render again/);
+});
+await ta('no key on the run → the provision result is untouched and Render is never called', async () => {
+  const h = afterHarness({ keyOnRow: null });
+  const r = { ok: true, already: true };
+  assert.equal(await afterProvision(h.inst, h.deps, { id: 44 }, r), r);
+  assert.equal(h.r.calls.length, 0);
+  assert.equal(h.cleared(), 0);
+});
+await ta('the runner reaches afterProvision on every provision run', () => {
+  const src = readFileSync(new URL('../scripts/gds/provision.js', import.meta.url), 'utf8');
+  assert.match(src, /intent\.action === 'provision'\) result = await require\('\.\/provision-render\.js'\)\.afterProvision\(inst, deps, intent, await provisionInstance\(inst, deps\)\)/);
+});
+await ta('a link needs a repository to check the service against (1004350 review)', async () => {
+  const h = harness({ host: { mode: 'adopt', serviceId: 'srv-old' } });
+  h.inst.target_ref = null;
+  const out = await h.run();
+  assert.equal(out.ok, false);
+  assert.equal(h.cleared(), 1);
+});
+await ta('an app with no build step sends no build command at all (1004350 review)', async () => {
+  const h = harness({ host: { buildCommand: undefined } });
+  await h.run();
+  const svc = h.r.calls.find((c) => c.method === 'POST' && c.path === '/services').body;
+  assert.deepEqual(svc.serviceDetails.envSpecificDetails, { startCommand: 'npm start' });
+});
+
 console.log('\nteardown forgets, never deletes:');
 await ta('forgetRenderApp records the disconnect and calls nothing', async () => {
   const writes = [], logs = [];

package/tests/provision_settings_apply.mjs

@@ -567,5 +567,67 @@ await ta('cmdRunIntents (--apply): a dedicated refusal RETIRES at the cap with t
   assert.match(statusWrites[0].patch.error_note, /dedicated/);
 });
 
+console.log('\nrenamedEnvCarry — the prelaunch password carried on the box (task 1004395):');
+
+// A value that could never appear anywhere by accident, so "not in the text" means something.
+const SECRET = 'zq7-Wall-Pass-$&-9x';
+
+t('carries the old name to the new one when ONLY the old name is set, copying the right-hand side verbatim', () => {
+  const r = P.renamedEnvCarry(`PORT=3002\nSTEALTH_PASSWORD=${SECRET}\n`);
+  assert.deepEqual(r.vars, { PRELAUNCH_PASSWORD: SECRET });
+  assert.deepEqual(r.carried, ['STEALTH_PASSWORD -> PRELAUNCH_PASSWORD']);
+  assert.deepEqual(P.renamedEnvCarry('STEALTH_PASSWORD="quoted pw"\n').vars, { PRELAUNCH_PASSWORD: '"quoted pw"' }, 'quotes kept, so systemd reads the same value');
+  assert.deepEqual(P.renamedEnvCarry(`A=1\r\nSTEALTH_PASSWORD=${SECRET}\r\n`).vars, { PRELAUNCH_PASSWORD: SECRET }, 'a CRLF file carries no stray \\r');
+});
+
+t('no-op when the new name is already set — even to a different value', () => {
+  for (const body of [`STEALTH_PASSWORD=${SECRET}\nPRELAUNCH_PASSWORD=${SECRET}\n`, `STEALTH_PASSWORD=${SECRET}\nPRELAUNCH_PASSWORD=other\n`, `PRELAUNCH_PASSWORD=${SECRET}\n`]) {
+    assert.deepEqual(P.renamedEnvCarry(body), { vars: {}, carried: [] }, body);
+  }
+});
+
+t('no-op when the old name is absent, empty or commented out; an EMPTY new line is still filled', () => {
+  for (const body of ['PORT=3002\n', 'STEALTH_PASSWORD=\n', 'STEALTH_PASSWORD=""\n', `# STEALTH_PASSWORD=${SECRET}\n`, 'X_STEALTH_PASSWORD=abc\n', '', null]) {
+    assert.deepEqual(P.renamedEnvCarry(body), { vars: {}, carried: [] }, String(body));
+  }
+  assert.deepEqual(P.renamedEnvCarry(`STEALTH_PASSWORD=${SECRET}\nPRELAUNCH_PASSWORD=\n`).vars, { PRELAUNCH_PASSWORD: SECRET });
+});
+
+t('the last line of a key wins, as systemd reads an EnvironmentFile', () => {
+  assert.deepEqual(P.renamedEnvCarry('STEALTH_PASSWORD=first\nSTEALTH_PASSWORD=second\n').vars, { PRELAUNCH_PASSWORD: 'second' });
+  assert.deepEqual(P.renamedEnvCarry('STEALTH_PASSWORD=pw\nPRELAUNCH_PASSWORD=set\nPRELAUNCH_PASSWORD=\n').vars, { PRELAUNCH_PASSWORD: 'pw' }, 'a later blank line unsets it');
+});
+
+await ta('the leg carries it in the SAME in-place patch: every other line untouched, the old name kept, the value in NO log, event or result', async () => {
+  const envBody = `${LIVE_ENV}STEALTH_PASSWORD=${SECRET}\n`;
+  const { deps, writes, events, logs } = recorder({ apply: true, envBody });
+  const r = await P.settingsApplyInstance(activeStandalone, deps);
+  assert.equal(r.ok, true, JSON.stringify(r));
+  const out = writes[0].body;
+  assert.ok(out.endsWith(`STEALTH_PASSWORD=${SECRET}\nPRELAUNCH_PASSWORD=${SECRET}\n`), 'appended after the old line, which stays for task 1003830 to retire');
+  assert.equal(out.split('\n').length, envBody.split('\n').length + 1, 'exactly one line added');
+  assert.match(out, /_GITHUB_CLIENT_SECRET=0123456789abcdef0123456789abcdef01234567/, 'creds untouched');
+  assert.match(events[0].detail, /carried STEALTH_PASSWORD -> PRELAUNCH_PASSWORD/, 'the event names the carry — how the owner verifies it without reading the file');
+  assert.ok(logs.some((l) => /carry the renamed env forward: STEALTH_PASSWORD -> PRELAUNCH_PASSWORD/.test(l)));
+  const said = [...logs, ...events.map((e) => e.detail), JSON.stringify(r)].join('\n');
+  assert.ok(!said.includes(SECRET) && !said.includes('zq7-Wall'), 'the password never leaves the file');
+});
+
+await ta('nothing to carry → the leg is byte-identical to before: no extra line, no carry wording', async () => {
+  const { deps, writes, events, logs } = recorder({ apply: true });
+  await P.settingsApplyInstance(activeStandalone, deps);
+  assert.equal(writes[0].body.split('\n').length, LIVE_ENV.split('\n').length);
+  assert.doesNotMatch(writes[0].body, /PRELAUNCH_PASSWORD/);
+  assert.doesNotMatch(events[0].detail, /carried/);
+  assert.ok(!logs.some((l) => /carry the renamed env/.test(l)));
+});
+
+await ta('a failed write reports the error without the value', async () => {
+  const { deps } = recorder({ apply: true, writeThrows: true, envBody: `${LIVE_ENV}STEALTH_PASSWORD=${SECRET}\n` });
+  const r = await P.settingsApplyInstance(activeStandalone, deps);
+  assert.equal(r.ok, false);
+  assert.ok(!r.error.includes(SECRET), r.error);
+});
+
 console.log(`\nprovision_settings_apply: ${passed} passed, ${failed} failed`);
 process.exit(failed ? 1 : 0);