@bongos/core 1.20.37 → 1.20.39

package/tests/npm_release_preview_diagnosis.mjs

@@ -0,0 +1,376 @@
+// tests/npm_release_preview_diagnosis.mjs — a preview that cannot serve data must say so (task 1004465).
+//
+// WHAT WENT WRONG LIVE. The first real preview started, answered /healthz, was reported
+// running, and then returned 500 on every page; the child's output went nowhere (stdio
+// 'ignore'), so nobody could say why. Stopping it left the copy database behind, because the
+// child was killed without waiting and the failed dropdb was ignored. These tests pin the four
+// repairs: the child's output is kept and redacted, the health check proves data can be read,
+// a stop waits for the child before dropping, and a drop that fails is reported, never idle.
+// Every spawn, command, probe, clock and file is injected.
+//
+// Run:  node --test tests/npm_release_preview_diagnosis.mjs
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { EventEmitter } from 'node:events';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const { createSupervisor, copyInstance } = require('../modules/npm-release/preview/supervisor.js');
+const cmds = require('../modules/npm-release/preview/commands.js');
+const { createChildLog, redact, secretValues } = require('../modules/npm-release/preview/childlog.js');
+const { probeHealth } = require('../modules/npm-release/preview/runtime.js');
+const { PREVIEW_DB, buildPreviewEnv } = require('../modules/npm-release/preview/env.js');
+
+const fwd = (x) => String(x).split(String.fromCharCode(92)).join('/');
+// Secret-shaped strings assembled at run time, so no scanner mistakes this file for a leak.
+const FAKE_GH = ['gh', 'p_', 'abcdefghijklmnopqrstuvwxyz0123'].join('');
+const FAKE_URL = ['post', 'gres://svc:pw9999@db/x'].join('');
+
+// `sleepMode`: 'instant' returns at once (the health loop's waits); 'never' returns only for
+// waits under a second, so a stop can be released ONLY by the child's real exit.
+function rig({ probe = async () => true, failRun = () => false, killBehaviour = 'exit', sleepMode = 'instant', instanceRoot = null, env, liveDb = 'live_db', copy } = {}) {
+  const events = [];
+  const calls = [];
+  const fake = { spawned: [], rm: [] };
+  const sup = createSupervisor({
+    run: async (cmd) => {
+      calls.push(cmd);
+      events.push(cmd.cmd);
+      return failRun(cmd) ? { code: 3, stderr: 'boom from ' + cmd.cmd } : { code: 0, stderr: '' };
+    },
+    spawn: (bin, args, opts) => {
+      const child = new EventEmitter();
+      child.stdout = new EventEmitter();
+      child.stderr = new EventEmitter();
+      child.bin = bin; child.args = args; child.opts = opts;
+      child.kill = (sig) => {
+        events.push('kill:' + sig);
+        if (killBehaviour === 'exit') setImmediate(() => { events.push('exit'); child.emit('exit', 0); });
+        if (killBehaviour === 'on-sigkill' && sig === 'SIGKILL') setImmediate(() => { events.push('exit'); child.emit('exit', null); });
+      };
+      fake.spawned.push(child);
+      return child;
+    },
+    probe,
+    sleep: (ms) => (sleepMode === 'instant' || ms < 1000 ? Promise.resolve() : sleepMode === 'short' ? new Promise((r) => setTimeout(r, 10)) : new Promise(() => {})),
+    now: () => 1_000_000,
+    fsImpl: { mkdtempSync: (p) => p + 'XYZ', mkdirSync() {}, rmSync: (p) => fake.rm.push(p), writeFile() {}, existsSync: () => false, readFileSync: () => { throw new Error('none'); } },
+    tmpdir: '/tmp', liveDb, cacheRoot: '/cache', port: 3190, instanceRoot, copy,
+    env: env || { PATH: '/bin' },
+  });
+  return { sup, events, calls, fake };
+}
+
+// ---- the child's output: kept, capped, redacted ---------------------------------------
+
+test('what the child printed is kept and shown when the preview cannot serve data', async () => {
+  const r = rig({
+    env: { PATH: '/bin', PGPASSWORD: 'hunter2pass', GITHUB_TOKEN: FAKE_GH },
+    probe: async () => {
+      r.fake.spawned[0].stderr.emit('data', 'error: relation "builders" does not exist\n');
+      r.fake.spawned[0].stdout.emit('data', `connecting with password=abc123 to ${FAKE_URL} using hunter2pass and ${FAKE_GH}\n`);
+      return { ok: false, reason: 'a database-backed read (/api/bongos/me) answered 500' };
+    },
+  });
+  await r.sup.start('1.19.1000').done;
+  const s = r.sup.status();
+  assert.equal(s.state, 'failed');
+  const tail = s.log_tail.join('\n');
+  assert.match(tail, /relation "builders" does not exist/);
+  assert.match(s.error, /Its last output:.*relation "builders" does not exist/);
+  for (const secret of ['hunter2pass', 'abc123', 'pw9999', FAKE_GH]) {
+    assert.ok(!tail.includes(secret), 'the tail leaks a secret');
+    assert.ok(!s.error.includes(secret), 'the error leaks a secret');
+  }
+});
+
+test('the tail is at most twenty lines and each line is short', () => {
+  const lg = createChildLog({});
+  lg.append(Array.from({ length: 50 }, (_, i) => 'line ' + i).join('\n') + '\n' + 'x'.repeat(1000) + '\n');
+  const t = lg.tail();
+  assert.equal(t.length, 20);
+  assert.ok(t.every((l) => l.length <= 301));
+});
+
+test('the log is capped, keeping the newest output', () => {
+  const lg = createChildLog({ cap: 100 });
+  lg.append('a'.repeat(500));
+  lg.append('THE-END');
+  assert.ok(lg.size() <= 100);
+  assert.match(lg.tail().join('\n'), /THE-END$/);
+});
+
+test('redaction takes out listed values and the common secret shapes', () => {
+  const secrets = secretValues({ SESSION_SECRET: 'sekrit-value-1', NOT_ONE: 'visible-value', PGPASSWORD: 'p' });
+  assert.deepEqual(secrets, ['sekrit-value-1'], 'only secret-named, long-enough values');
+  const out = redact(`x sekrit-value-1 y Bearer abc.def-ghi ${FAKE_URL} token=zzz visible-value`, secrets);
+  assert.ok(!/sekrit-value-1|abc\.def|pw9999|zzz/.test(out), out);
+  assert.match(out, /visible-value/);
+});
+
+test('the log is also written to a file in the scratch directory, and a failing disk does not matter', () => {
+  const writes = [];
+  const lg = createChildLog({ fsImpl: { writeFile: (f, b, cb) => { writes.push([f, b]); cb(); } }, file: '/tmp/x/preview.log', flushMs: 1e6 });
+  lg.append('hello');
+  lg.flush();
+  assert.deepEqual(writes, [['/tmp/x/preview.log', 'hello']]);
+  lg.close();
+  const broken = createChildLog({ fsImpl: { writeFile() { throw new Error('disk'); } }, file: '/f', flushMs: 1e6 });
+  broken.append('still fine');
+  assert.doesNotThrow(() => broken.flush());
+  broken.close();
+});
+
+test('a burst of output costs one asynchronous write, never one write per chunk, and none after close', async () => {
+  const writes = [];
+  const lg = createChildLog({ fsImpl: { writeFile: (f, b, cb) => { writes.push(b); cb(); } }, file: '/f', flushMs: 5 });
+  for (let i = 0; i < 500; i++) lg.append('line ' + i + '\n');
+  assert.equal(writes.length, 0, 'nothing is written inside the data handler');
+  await new Promise((r) => setTimeout(r, 40));
+  assert.equal(writes.length, 1, 'the burst was written once');
+  assert.match(writes[0], /line 499/);
+  lg.append('after');
+  lg.close();
+  await new Promise((r) => setTimeout(r, 40));
+  assert.equal(writes.length, 1, 'closing cancels a pending write');
+});
+
+// ---- ready means it can serve data ----------------------------------------------------
+
+test('a probe that sees a database failure fails the preview, says why, and cleans up', async () => {
+  const { sup, events, fake, calls } = rig({ probe: async () => ({ ok: false, reason: '/version reports schemaPending null: the database copy could not be read' }) });
+  await sup.start('1.19.1000').done;
+  const s = sup.status();
+  assert.equal(s.state, 'failed');
+  assert.match(s.error, /could not serve data/);
+  assert.match(s.error, /schemaPending null/);
+  assert.ok(events.includes('kill:SIGTERM'), 'the child was stopped');
+  assert.deepEqual(calls[calls.length - 1], cmds.dropDbCommand(), 'the copy was dropped');
+  assert.equal(fake.rm.length, 1, 'the scratch directory was removed');
+});
+
+test('a preview is running only once the probe says it can serve data', async () => {
+  const answers = [{ ok: false, reason: 'warming up' }, { ok: false, reason: 'warming up' }, { ok: true }];
+  const { sup } = rig({ probe: async () => answers.shift() });
+  await sup.start('1.19.1000').done;
+  assert.equal(sup.status().state, 'running');
+});
+
+test('a bare true from the probe still counts as healthy (older callers)', async () => {
+  const { sup } = rig({ probe: async () => true });
+  await sup.start('1.19.1000').done;
+  assert.equal(sup.status().state, 'running');
+});
+
+test('a child that exits while starting fails the start at once, with its output', async () => {
+  let probes = 0;
+  const r = rig({
+    probe: async () => {
+      probes += 1;
+      r.fake.spawned[0].stderr.emit('data', 'Error: Cannot find module "./nope"\n');
+      r.fake.spawned[0].emit('exit', 1);
+      return false;
+    },
+  });
+  await r.sup.start('1.19.1000').done;
+  assert.equal(probes, 1, 'it did not keep probing a dead child');
+  assert.match(r.sup.status().error, /exited \(1\) before it could serve data/);
+  assert.match(r.sup.status().error, /Cannot find module/);
+  assert.equal(r.sup.status().state, 'failed');
+});
+
+// ---- the probe itself ------------------------------------------------------------------
+
+function fakeGet(map) {
+  return async (port, p) => map[p] || { error: 'refused' };
+}
+const HEALTHZ = { status: 200, body: '{}' };
+const OK = { status: 200, body: '{"coreVersion":"1.19.1000","schemaPending":0}' };
+
+test('the probe passes only when healthz, /version and a database-backed read all answer', async () => {
+  const r = await probeHealth(3190, fakeGet({ '/healthz': HEALTHZ, '/version': OK, '/api/bongos/me': { status: 401, body: '{}' } }));
+  assert.deepEqual(r, { ok: true });
+});
+
+test('schemaPending null (the database read failed) fails the probe even though /healthz is 200', async () => {
+  const r = await probeHealth(3190, fakeGet({ '/healthz': HEALTHZ, '/version': { status: 200, body: '{"schemaPending":null,"commit":null}' }, '/api/bongos/me': { status: 401, body: '' } }));
+  assert.equal(r.ok, false);
+  assert.match(r.reason, /schemaPending null/);
+});
+
+test('a 500 from a database-backed route fails the probe', async () => {
+  const r = await probeHealth(3190, fakeGet({ '/healthz': HEALTHZ, '/version': OK, '/api/bongos/me': { status: 500, body: '' } }));
+  assert.equal(r.ok, false);
+  assert.match(r.reason, /\/api\/bongos\/me\) answered 500/);
+});
+
+test('a version too old to report schemaPending is judged by the database-backed read alone', async () => {
+  const old = { status: 200, body: '{"coreVersion":"1.0.1"}' };
+  const good = await probeHealth(3190, fakeGet({ '/healthz': HEALTHZ, '/version': old, '/api/bongos/me': { status: 401, body: '' } }));
+  assert.equal(good.ok, true);
+  const bad = await probeHealth(3190, fakeGet({ '/healthz': HEALTHZ, '/version': old, '/api/bongos/me': { status: 500, body: '' } }));
+  assert.equal(bad.ok, false);
+});
+
+test('nothing answering, or /healthz not 200, fails the probe', async () => {
+  assert.equal((await probeHealth(3190, fakeGet({}))).ok, false);
+  assert.equal((await probeHealth(3190, fakeGet({ '/healthz': { status: 503, body: '' } }))).ok, false);
+});
+
+// ---- the child's working directory is an instance --------------------------------------
+
+test('the child runs in a scratch instance holding the live config, and is told so', async () => {
+  const copied = [];
+  const { sup, fake, calls } = rig({ instanceRoot: '/live/root', copy: (o) => copied.push([o.from, fwd(o.to)]) });
+  await sup.start('1.19.1000').done;
+  assert.deepEqual(copied, [['/live/root', '/tmp/bongos-preview-XYZ/instance']]);
+  const child = fake.spawned[0];
+  assert.equal(fwd(child.opts.cwd), '/tmp/bongos-preview-XYZ/instance');
+  assert.equal(fwd(child.opts.env.BONGOS_INSTANCE_ROOT), '/tmp/bongos-preview-XYZ/instance');
+  const migrate = calls.find((c) => c.cmd === 'bash');
+  assert.equal(fwd(migrate.cwd), '/tmp/bongos-preview-XYZ/instance');
+  assert.equal(fwd(migrate.env.INIT_CWD), '/tmp/bongos-preview-XYZ/instance');
+  assert.equal(migrate.env.PGDATABASE, PREVIEW_DB);
+});
+
+test('without an instance root the child still runs from its install directory', async () => {
+  const { sup, fake } = rig();
+  await sup.start('1.19.1000').done;
+  assert.equal(fwd(fake.spawned[0].opts.cwd), '/cache/1.19.1000');
+  assert.equal(fake.spawned[0].opts.env.BONGOS_INSTANCE_ROOT, undefined);
+});
+
+test('copying the instance takes the boot packs and instance migrations, and nothing else from config', () => {
+  const from = fs.mkdtempSync(path.join(os.tmpdir(), 'pv-from-'));
+  const to = fs.mkdtempSync(path.join(os.tmpdir(), 'pv-to-'));
+  try {
+    fs.mkdirSync(path.join(from, 'config'));
+    fs.mkdirSync(path.join(from, 'migrations', 'instance'), { recursive: true });
+    fs.writeFileSync(path.join(from, 'config', 'branding.json'), '{"envPrefix":"ACME"}');
+    fs.writeFileSync(path.join(from, 'config', 'modules.json'), '{}');
+    // files that are not on the allow-list stay behind whatever they are called
+    for (const name of ['go-live.json', 'push-token.json', 'apikey.json', 'db-creds.json', 'notes.txt']) fs.writeFileSync(path.join(from, 'config', name), '{}');
+    fs.writeFileSync(path.join(from, 'migrations', 'instance', '0001_x.sql'), 'select 1;');
+    copyInstance({ fsImpl: fs, from, to });
+    assert.deepEqual(fs.readdirSync(path.join(to, 'config')).sort(), ['branding.json', 'modules.json']);
+    assert.deepEqual(fs.readdirSync(path.join(to, 'migrations', 'instance')), ['0001_x.sql']);
+    // an instance with neither directory is not an error
+    copyInstance({ fsImpl: fs, from: path.join(from, 'nowhere'), to });
+  } finally {
+    fs.rmSync(from, { recursive: true, force: true });
+    fs.rmSync(to, { recursive: true, force: true });
+  }
+});
+
+test('the module switches cover every env prefix the core resolves (a tripwire against drift)', () => {
+  const ic = require('../src/instance-config');
+  const { MODULES_OFF } = require('../modules/npm-release/preview/env.js');
+  for (const pfx of [ic.FALLBACK_ENV_PREFIX, ...ic.LEGACY_ENV_PREFIXES]) {
+    assert.ok(MODULES_OFF.includes(pfx + '_MODULE_DISCORD'), 'no switch under the ' + pfx + ' prefix: a prefix the core reads would leave the module on');
+  }
+});
+
+test('the module switches are set under every prefix, including the copied instance own', () => {
+  const env = buildPreviewEnv({ port: 3190, scratchHome: '/h', instanceRoot: '/i', envPrefix: 'ACME' });
+  for (const pfx of ['BONGOS', 'CLOUDBONGOS', 'OTB', 'GDS', 'PMS', 'ACME']) {
+    assert.equal(env[pfx + '_MODULE_DISCORD'], '0', pfx);
+    assert.equal(env[pfx + '_MODULE_AGENTS'], '0', pfx);
+  }
+  assert.equal(buildPreviewEnv({ port: 1, scratchHome: '/h', envPrefix: 'bad prefix; rm' }).ACME_MODULE_DISCORD, undefined);
+});
+
+// ---- stopping really drops the copy ------------------------------------------------------
+
+test('stop waits for the child to exit before it drops the copy', async () => {
+  // sleepMode "never": nothing but the child's own exit can let the stop go on.
+  const { sup, events } = rig({ sleepMode: 'never' });
+  await sup.start('1.19.1000').done;
+  events.length = 0;
+  await sup.stop();
+  assert.deepEqual(events, ['kill:SIGTERM', 'exit', 'dropdb']);
+  assert.equal(sup.status().state, 'idle');
+});
+
+test('a child that ignores SIGTERM is killed with SIGKILL before the drop', async () => {
+  const { sup, events } = rig({ killBehaviour: 'on-sigkill', sleepMode: 'short' });
+  await sup.start('1.19.1000').done;
+  events.length = 0;
+  await sup.stop();
+  assert.deepEqual(events, ['kill:SIGTERM', 'kill:SIGKILL', 'exit', 'dropdb']);
+});
+
+test('a failed dropdb is retried after ending the copy backends, then reported instead of idle', async () => {
+  let failing = false;
+  const { sup, calls } = rig({ failRun: (c) => failing && c.cmd === 'dropdb' });
+  await sup.start('1.19.1000').done;
+  failing = true;
+  calls.length = 0;
+  const s = await sup.stop();
+  assert.deepEqual(calls.map((c) => c.cmd), ['dropdb', 'psql', 'dropdb']);
+  assert.equal(calls[0].args.includes('--force'), true);
+  assert.equal(calls[2].args.includes('--force'), false, 'the retry is plain');
+  assert.equal(s.state, 'failed');
+  assert.equal(s.stage, 'drop');
+  assert.match(s.error, /could not be dropped/);
+  assert.equal(sup.status().state, 'failed', 'and it stays reported until a drop works');
+});
+
+test('a dropdb that fails only for want of --force is rescued by the fallback', async () => {
+  let forceFails = false;
+  const { sup } = rig({ failRun: (c) => forceFails && c.cmd === 'dropdb' && c.args.includes('--force') });
+  await sup.start('1.19.1000').done;
+  forceFails = true;
+  const s = await sup.stop();
+  assert.equal(s.state, 'idle');
+});
+
+test('a failed start whose copy will not drop says both things', async () => {
+  let dropsFail = false;
+  const { sup } = rig({
+    probe: async () => { dropsFail = true; return { ok: false, reason: 'the data path is broken' }; },
+    failRun: (c) => dropsFail && c.cmd === 'dropdb',
+  });
+  await sup.start('1.19.1000').done;
+  const s = sup.status();
+  assert.equal(s.state, 'failed');
+  assert.match(s.error, /the data path is broken/);
+  assert.match(s.error, /could not be dropped/);
+});
+
+// ---- the drop can never name the live database ---------------------------------------------
+
+test('a supervisor whose live database is the preview name cannot be built', () => {
+  assert.throws(() => rig({ liveDb: PREVIEW_DB }), /cannot be named bongos_preview/);
+});
+
+test('every drop command names the fixed copy, and nothing else passes the guard', () => {
+  for (const c of [cmds.dropDbCommand(), cmds.dropDbPlainCommand(), cmds.terminateBackendsCommand()]) {
+    assert.equal(cmds.targetsOnlyPreviewDb(c), true, JSON.stringify(c));
+    assert.ok(JSON.stringify(c).includes(PREVIEW_DB));
+  }
+  for (const bad of [
+    { cmd: 'dropdb', args: ['--if-exists', 'live_db'] },
+    { cmd: 'dropdb', args: ['live_db', PREVIEW_DB] },
+    { cmd: 'dropdb', args: ['--if-exists', '--force', 'live_db'] },
+    { cmd: 'psql', args: ['-d', 'postgres', '-c', 'DROP DATABASE live_db'] },
+    { cmd: 'psql', args: ['-X', '-d', 'postgres', '-tAc', "SELECT pg_terminate_backend(pid) FROM pg_stat_activity WHERE datname = 'live_db'"] },
+    { cmd: 'bash', args: ['-c', 'dropdb ' + PREVIEW_DB] },
+    null,
+  ]) assert.equal(cmds.targetsOnlyPreviewDb(bad), false, JSON.stringify(bad));
+  assert.match(cmds.terminateBackendsCommand().args.join(' '), /datname = 'bongos_preview' AND pid <> pg_backend_pid\(\)/);
+});
+
+test('every drop-capable command a start and stop runs is the guarded kind, none naming the live database', async () => {
+  const { sup, calls } = rig({ failRun: (c) => c.cmd === 'dropdb' });
+  await sup.start('1.19.1000').done;
+  await sup.stop();
+  const risky = calls.filter((x) => x.cmd === 'dropdb' || x.cmd === 'psql');
+  assert.ok(risky.length > 0);
+  for (const c of risky) {
+    assert.equal(cmds.targetsOnlyPreviewDb(c), true, JSON.stringify(c));
+    assert.ok(!JSON.stringify(c.args).includes('live_db'));
+  }
+});

package/tests/npm_release_preview_supervisor.mjs

@@ -28,7 +28,7 @@ function rig({ failOn, probeResults, env } = {}) {
     },
     spawn: (bin, args, opts) => {
       const handlers = {};
-      const child = { bin, args, opts, on: (ev, fn) => { handlers[ev] = fn; }, kill: () => { fake.killed += 1; }, emit: (ev, ...a) => handlers[ev] && handlers[ev](...a) };
+      const child = { bin, args, opts, on: (ev, fn) => { handlers[ev] = fn; }, kill: (sig) => { fake.killed += 1; (fake.signals ||= []).push(sig); if (handlers.exit) handlers.exit(0); }, emit: (ev, ...a) => handlers[ev] && handlers[ev](...a) };
       fake.spawned.push(child);
       return child;
     },
@@ -46,7 +46,7 @@ function rig({ failOn, probeResults, env } = {}) {
 }
 
 const fwd = (x) => String(x).split(String.fromCharCode(92)).join('/');
-const DROP = { cmd: 'dropdb', args: ['--if-exists', PREVIEW_DB] };
+const DROP = { cmd: 'dropdb', args: ['--if-exists', '--force', PREVIEW_DB] };
 
 test('a start runs install, copy, restore and migrate, in that order, then launches and waits for health', async () => {
   const { sup, calls, fake } = rig();
@@ -89,9 +89,9 @@ for (const failOn of ['npm', 'dropdb', 'createdb', 'dump', 'pg_restore', 'bash']
     await sup.start('1.19.1000').done;
     const s = sup.status();
     assert.equal(s.state, 'failed');
-    assert.match(s.error, /failed \(exit 3\)/);
+    assert.match(s.error, failOn === 'dropdb' ? /could not be dropped/ : /failed [(]exit 3[)]/);
     assert.equal(fake.spawned.length, 0, 'no process was started');
-    assert.deepEqual(calls[calls.length - 1], DROP, 'the copy is dropped last');
+    if (failOn !== 'dropdb') assert.deepEqual(calls[calls.length - 1], DROP, 'the copy is dropped last');
     assert.equal(rmCalls.length, 1, 'the scratch directory is removed');
   });
 }

package/tests/projects_hub_app_step.mjs

@@ -23,6 +23,8 @@ import fs from 'node:fs';
 import path from 'node:path';
 import vm from 'node:vm';
 import { fileURLToPath } from 'node:url';
+import { createRequire } from 'node:module';
+const require = createRequire(import.meta.url);
 
 const ROOT = path.join(path.dirname(fileURLToPath(import.meta.url)), '..');
 const HUB = fs.readFileSync(path.join(ROOT, 'modules', 'public-landing', 'public', 'projects.html'), 'utf8').replace(/\r\n/g, '\n');
@@ -301,6 +303,53 @@ test('typing a start command clears the "how your app starts" ask at once', asyn
   assert.doesNotMatch(w.$('h-render').textContent, /how your app starts/);
 });
 
+// task 1004464 — Render refused a native app with no build command, live, on project 43.
+test('the build command starts as the runtime\'s usual one, follows the runtime, and yields to the owner\'s own', async () => {
+  const w = load({ answers: ANSWERS, draft: { appPlatform: 'render' } });
+  w.typeKey(KEY);
+  await w.check();
+  await w.pickWorkspace(0);
+  w.pickService({ value: 'new' });
+  assert.equal(w.$('f-renderBuild').value, 'npm install', 'Node.js starts with npm install');
+  w.$('f-renderRuntime').value = 'python';
+  w.$('renderNew').fire('change', { target: w.$('f-renderRuntime') });
+  assert.equal(w.$('f-renderBuild').value, 'pip install -r requirements.txt', 'it follows the runtime');
+  w.$('f-renderBuild').value = 'make build';
+  w.$('renderNew').fire('input', { target: w.$('f-renderBuild') });
+  w.$('f-renderRuntime').value = 'ruby';
+  w.$('renderNew').fire('change', { target: w.$('f-renderRuntime') });
+  assert.equal(w.$('f-renderBuild').value, 'make build', 'the owner\'s own command is never overwritten');
+  w.state.renderStart = 'bundle exec puma';
+  assert.equal(w.renderRequestBody().build_command, 'make build');
+});
+
+test('an emptied build command is refused before Render ever sees it, and the ask clears on typing', async () => {
+  const w = load({ answers: ANSWERS, draft: { appPlatform: 'render' } });
+  w.typeKey(KEY);
+  await w.check();
+  await w.pickWorkspace(0);
+  w.pickService({ value: 'new' });
+  w.state.renderStart = 'npm start';
+  w.$('f-renderBuild').value = '';
+  w.$('renderNew').fire('input', { target: w.$('f-renderBuild') });
+  assert.equal(w.validateRender(), false);
+  assert.match(w.$('h-render').textContent, /how your app is built/);
+  w.$('f-renderBuild').value = 'npm ci';
+  w.$('renderNew').fire('input', { target: w.$('f-renderBuild') });
+  assert.doesNotMatch(w.$('h-render').className, /err/);
+  assert.equal(w.validateRender(), true);
+});
+
+test('the page\'s build defaults are the runner\'s, key for key', () => {
+  const { BUILD_DEFAULTS, RUNTIMES } = require('../modules/provisioning/render-standup.js');
+  const src = HUB.replace(/\r\n/g, '\n').match(/var RENDER_BUILD_DEFAULTS = (\{[\s\S]*?\});/);
+  assert.ok(src, 'the page carries RENDER_BUILD_DEFAULTS');
+  const page = vm.runInNewContext('(' + src[1] + ')');
+  assert.deepEqual({ ...page }, { ...BUILD_DEFAULTS });
+  assert.deepEqual(Object.keys(page).sort(), RUNTIMES.filter((r) => r !== 'docker').sort());
+  assert.doesNotMatch(HUB, /leave empty if there is none/);
+});
+
 test('the empty command boxes read as examples, not as filled-in values', () => {
   assert.match(HUB, /id="f-renderBuild"[^>]*placeholder="for example: npm ci"/);
   assert.match(HUB, /id="f-renderStart"[^>]*placeholder="for example: npm start"/);

package/tests/projects_hub_render_connect.mjs

@@ -250,7 +250,8 @@ test('Connect sends the key once, to this project, forgets it, and the card show
   const sent = w.calls.filter((c) => c.url === RENDER);
   assert.equal(sent.length, 1);
   assert.equal(sent[0].method, 'POST');
-  assert.deepEqual(sent[0].body, { key: KEY, owner_id: TEA_A, mode: 'greenfield', runtime: 'node', start_command: 'npm start', web_plan: 'starter', database: false });
+  // build_command: the runtime's usual one, prefilled — Render refuses a native app without one (task 1004464)
+  assert.deepEqual(sent[0].body, { key: KEY, owner_id: TEA_A, mode: 'greenfield', runtime: 'node', start_command: 'npm start', build_command: 'npm install', web_plan: 'starter', database: false });
   for (const c of w.calls) assert.ok(!c.url.includes(KEY), 'no URL carries the key');
   assert.equal(w.q('f-renderKey').value, '', 'the field is emptied');
   assert.equal(w.byId('mAppConnectForm').hidden, true, 'the form closes');

package/tests/provision_render.mjs

@@ -335,11 +335,32 @@ await ta('a link needs a repository to check the service against (1004350 review
   assert.equal(out.ok, false);
   assert.equal(h.cleared(), 1);
 });
-await ta('an app with no build step sends no build command at all (1004350 review)', async () => {
+// The 1004350 review asked for NO build command here; Render refused exactly that live
+// ("buildCommand is required for non-static, non-docker services", task 1004464), so a
+// row saved without one — every row from before the fix included — gets the runtime's
+// default, and a Retry of such a row now works.
+await ta('an app saved with no build command gets its runtime\'s default, as Render requires (task 1004464)', async () => {
   const h = harness({ host: { buildCommand: undefined } });
   await h.run();
   const svc = h.r.calls.find((c) => c.method === 'POST' && c.path === '/services').body;
-  assert.deepEqual(svc.serviceDetails.envSpecificDetails, { startCommand: 'npm start' });
+  assert.deepEqual(svc.serviceDetails.envSpecificDetails, { buildCommand: 'npm install', startCommand: 'npm start' });
+});
+await ta('every native runtime has a default build command; docker still sends none (task 1004464)', () => {
+  const { RUNTIMES, BUILD_DEFAULTS } = require('../modules/provisioning/render-standup.js');
+  const { buildFor } = require('../scripts/gds/render-payload.js');
+  for (const rt of RUNTIMES.filter((r) => r !== 'docker')) {
+    assert.ok(BUILD_DEFAULTS[rt], `${rt} has a default`);
+    assert.equal(buildFor({ runtime: rt, startCommand: 'x' }).buildCommand, BUILD_DEFAULTS[rt]);
+    assert.equal(buildFor({ runtime: rt, startCommand: 'x', buildCommand: 'make' }).buildCommand, 'make', 'the owner\'s own wins');
+  }
+  assert.deepEqual(buildFor({ runtime: 'docker' }), { runtime: 'docker' });
+});
+await ta('a refusal from Render reads as a sentence, with Render\'s own reason kept (task 1004464)', async () => {
+  const h = harness({ host: { database: false }, render: { 'POST /services': new Error('buildCommand is required for non-static, non-docker services.') } });
+  const out = await h.run();
+  assert.equal(out.ok, false);
+  assert.equal(h.lastHost().error, 'Render would not set up the app: buildCommand is required for non-static, non-docker services.');
+  assert.doesNotMatch(h.lastHost().error, /POST \/services/, 'no raw HTTP line reaches the owner');
 });
 
 console.log('\nteardown forgets, never deletes:');

package/tests/update_channel_db.mjs

@@ -0,0 +1,124 @@
+// tests/update_channel_db.mjs — the unattended sweep follows the update rule set on /deploy
+// (task 1004468, ADR 0357).
+//
+// WHY. /deploy writes provisioning_instances.update_channel (task 1004445), and the Upgrade button
+// obeys it — but the sweep read only the roster file, so cloudbongos.com was set to `minor` on the
+// site and still swept as `patch` (task 1004451's failed proof). These pin the rule: a project row
+// wins, the roster is the fallback, and every fallback says why.
+//
+// Run:  node --test tests/update_channel_db.mjs
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const uc = require('../scripts/gds/update-channel.js');
+
+const AVAILABLE = ['1.20.36', '1.20.37', '1.21.0', '2.0.0'];
+const entry = (over = {}) => ({ slug: 'cloudbongos', dir: '/home/lars/cloudbongos', channel: 'patch', env: {}, ...over });
+const dbOf = (rows) => ({ ok: true, channels: new Map(Object.entries(rows)) });
+const targetFor = (inst) => uc.resolveChannelTarget({ installed: '1.20.37', channel: inst.channel, available: AVAILABLE });
+
+test('DB minor + roster patch: the /deploy rule wins and a 1.21.0 target is chosen', () => {
+  const [inst] = uc.applyDbChannels([entry()], dbOf({ cloudbongos: 'minor' }));
+  assert.equal(inst.channel, 'minor');
+  assert.equal(inst.channelSource, uc.CHANNEL_SOURCE_DEPLOY);
+  assert.equal(inst.rosterChannel, 'patch');
+  assert.match(inst.channelNote, /set on \/deploy \(roster says patch, ignored\)/);
+  assert.equal(targetFor(inst), '1.21.0');
+  // Control: the roster alone would have held it on the patch line.
+  assert.equal(targetFor(entry()), null);
+});
+
+test('no project row for the slug: the roster wins, and the log says why', () => {
+  const [inst] = uc.applyDbChannels([entry({ slug: 'charter', channel: 'patch' })], dbOf({ cloudbongos: 'minor' }));
+  assert.equal(inst.channel, 'patch');
+  assert.equal(inst.channelSource, uc.CHANNEL_SOURCE_ROSTER);
+  assert.match(inst.channelNote, /no project row for this slug/);
+});
+
+test('DB pinned: the sweep skips it even when the roster says minor', () => {
+  const [inst] = uc.applyDbChannels([entry({ channel: 'minor' })], dbOf({ cloudbongos: 'pinned' }));
+  assert.equal(inst.channel, 'pinned');
+  assert.equal(targetFor(inst), null);
+  // subscribe.js skips on exactly this value, and decides it AFTER the DB rule is applied.
+  const src = readFileSync(path.join(ROOT, '.claude/scheduled-tasks/core-update-subscription/subscribe.js'), 'utf8');
+  const applied = src.indexOf('channel.applyDbChannels(');
+  const skip = src.indexOf("inst.channel === 'pinned'");
+  assert.ok(applied > 0 && skip > applied, 'the pinned skip must read the channel after the /deploy rule is applied');
+});
+
+test('database unreachable: every entry keeps its roster channel and carries the reason', () => {
+  const insts = uc.applyDbChannels([entry(), entry({ slug: 'charter', channel: 'minor' })], { ok: false, reason: 'psql not found' });
+  assert.deepEqual(insts.map((i) => i.channel), ['patch', 'minor']);
+  for (const i of insts) assert.match(i.channelNote, /from the roster — psql not found/);
+});
+
+test('an unknown value in the row normalises like any channel (never widens)', () => {
+  const [inst] = uc.applyDbChannels([entry()], dbOf({ cloudbongos: 'major' }));
+  assert.equal(inst.channel, uc.normalizeChannel('major'));
+  assert.notEqual(inst.channel, 'minor');
+});
+
+test('readDbChannels: no database named → not read, with the reason, and psql is never spawned', () => {
+  let spawned = false;
+  const r = uc.readDbChannels({ env: {}, run: () => { spawned = true; } });
+  assert.equal(r.ok, false);
+  assert.match(r.reason, /no DATABASE_URL or PGDATABASE/);
+  assert.equal(spawned, false);
+});
+
+test('readDbChannels: parses psql -At tab output into slug → channel, from the sweep env only', () => {
+  let args;
+  const run = (cmd, a) => { args = [cmd, ...a]; return { status: 0, stdout: 'cloudbongos\tminor\ncharter\tpatch\n\n', stderr: '' }; };
+  const r = uc.readDbChannels({ env: { PGDATABASE: 'cloudbongos' }, run });
+  assert.equal(r.ok, true);
+  assert.equal(r.channels.get('cloudbongos'), 'minor');
+  assert.equal(r.channels.get('charter'), 'patch');
+  assert.equal(r.channels.size, 2);
+  assert.deepEqual(args.slice(0, 3), ['psql', '-d', 'cloudbongos']);
+  assert.ok(args.includes('ON_ERROR_STOP=1'));
+});
+
+test('readDbChannels: DATABASE_URL is preferred over PGDATABASE', () => {
+  let target;
+  uc.readDbChannels({ env: { DATABASE_URL: 'postgres://u@h/db', PGDATABASE: 'x' }, run: (_c, a) => { target = a[1]; return { status: 0, stdout: '' }; } });
+  assert.equal(target, 'postgres://u@h/db');
+});
+
+test('readDbChannels: a missing table or psql fails soft with a one-line reason', () => {
+  const noTable = uc.readDbChannels({ env: { PGDATABASE: 'db' }, run: () => ({ status: 1, stdout: '', stderr: 'ERROR:  relation "provisioning_instances" does not exist\nLINE 1: ...' }) });
+  assert.equal(noTable.ok, false);
+  assert.equal(noTable.reason, 'psql exit 1: no provisioning_instances table (provisioning module off?)');
+  const noPsql = uc.readDbChannels({ env: { PGDATABASE: 'db' }, run: () => ({ error: Object.assign(new Error('spawn psql ENOENT'), { code: 'ENOENT' }) }) });
+  assert.deepEqual(noPsql, { ok: false, reason: 'psql not found' });
+});
+
+test('readDbChannels: psql stderr never reaches the reason (it can name a DB user or host)', () => {
+  const stderr = 'psql: error: connection to server at "db.internal.example" (10.0.0.5), port 5432 failed: FATAL:  password authentication failed for user "cloudbongos_admin"';
+  const r = uc.readDbChannels({ env: { DATABASE_URL: 'postgres://x' }, run: () => ({ status: 2, stdout: '', stderr }) });
+  assert.equal(r.reason, "psql exit 2: the sweep's database login was refused");
+  for (const leak of ['db.internal.example', '10.0.0.5', 'cloudbongos_admin']) assert.ok(!r.reason.includes(leak), `reason leaked ${leak}`);
+  assert.equal(uc.psqlFailureClass('something nobody anticipated for user "secret_user"'), 'query failed');
+});
+
+test('channelLine: the sweep log names the channel and where it came from', () => {
+  const [fromDeploy, fromRoster] = uc.applyDbChannels(
+    [entry(), entry({ slug: 'charter', channel: 'patch' })], dbOf({ cloudbongos: 'minor' }));
+  assert.equal(uc.channelLine(fromDeploy), '  • cloudbongos: channel minor, set on /deploy (roster says patch, ignored)');
+  assert.equal(uc.channelLine(fromRoster), '  • charter: channel patch, from the roster — no project row for this slug');
+  const src = readFileSync(path.join(ROOT, '.claude/scheduled-tasks/core-update-subscription/subscribe.js'), 'utf8');
+  assert.match(src, /console\.log\(channel\.channelLine\(inst\)\)/);
+});
+
+test('subscribe.js reads the DB from its own env, never an entry env (which names that instance\'s DB)', () => {
+  const src = readFileSync(path.join(ROOT, '.claude/scheduled-tasks/core-update-subscription/subscribe.js'), 'utf8');
+  assert.match(src, /channel\.readDbChannels\(\{ env: process\.env \}\)/);
+  // A core too old to carry the reader must keep the roster rather than crash the sweep.
+  assert.match(src, /typeof channel\.readDbChannels === 'function'/);
+});