@bongos/core 1.20.38 → 1.20.39

package/modules/provisioning/render-standup.js

@@ -31,6 +31,18 @@ const MODES = ['adopt', 'greenfield'];
 // How the owner's app is built (task 1004350): a native runtime with their commands, or
 // `docker`, which builds the repository's own Dockerfile.
 const RUNTIMES = ['node', 'python', 'ruby', 'go', 'rust', 'elixir', 'docker'];
+// Render refuses a native web service with no build command (measured live 2026-09-30,
+// task 1004464), so every native runtime has one: Render's own default for it. The runner
+// sends it when the owner gave none, and the wizard prefills it (projects.html keeps a
+// copy, pinned equal by tests/projects_hub_app_step.mjs).
+const BUILD_DEFAULTS = Object.freeze({
+  node: 'npm install',
+  python: 'pip install -r requirements.txt',
+  ruby: 'bundle install',
+  go: 'go build -tags netgo -ldflags \'-s -w\' -o app',
+  rust: 'cargo build --release',
+  elixir: 'mix deps.get --only prod && MIX_ENV=prod mix compile',
+});
 
 // Render API keys start `rnd_`; workspaces are `tea-…` (a team) or `usr-…` (a personal
 // one); services `srv-…`. Shape checks only — whether the key works, and whether it can
@@ -134,4 +146,4 @@ async function attachToProvision(db, instanceId, { keyEnc, appHost }) {
   return rows[0] || null;
 }
 
-module.exports = { attachToProvision, KEY_RE, OWNER_RE, WEB_PLANS, DB_PLANS, REGIONS, MODES, RUNTIMES, badRequest, appHostFrom, enqueueRenderStandup };
+module.exports = { attachToProvision, KEY_RE, OWNER_RE, WEB_PLANS, DB_PLANS, REGIONS, MODES, RUNTIMES, BUILD_DEFAULTS, badRequest, appHostFrom, enqueueRenderStandup };

package/modules/public-landing/public/projects.html

@@ -1433,7 +1433,7 @@ summary{min-height:24px;padding:3px 0;}
                       <option value="docker">Docker — use my repository’s Dockerfile</option>
                     </select>
                   </label>
-                  <label class="wizField" id="renderBuildWrap"><span>Build command <small>— leave empty if there is none</small></span>
+                  <label class="wizField" id="renderBuildWrap"><span>Build command <small>— Render needs one; the usual one is filled in</small></span>
                     <input type="text" id="f-renderBuild" autocomplete="off" spellcheck="false" maxlength="500" placeholder="for example: npm ci">
                   </label>
                   <label class="wizField" id="renderStartWrap"><span>Start command</span>
@@ -1808,6 +1808,18 @@ summary{min-height:24px;padding:3px 0;}
   function planPrice(p) { return p[2] ? 'about $' + p[2] + '/month' : RENDER_FREE_NOTE; }
   var RENDER_DB_PLANS = [['basic_256mb', 'Basic 256 MB', 6], ['basic_1gb', 'Basic 1 GB', 19], ['basic_4gb', 'Basic 4 GB', 75]];
   var RENDER_RUNTIMES = { node: 'Node.js', python: 'Python', ruby: 'Ruby', go: 'Go', rust: 'Rust', elixir: 'Elixir', docker: 'Docker' };
+  /* Render refuses a native app with no build command (task 1004464), so the box starts
+     with Render's own default for the runtime — a real value the owner can change, and
+     one that follows the runtime until they do. A copy of render-standup.js's
+     BUILD_DEFAULTS (this page cannot require it), pinned equal by a test. */
+  var RENDER_BUILD_DEFAULTS = {
+    node: 'npm install',
+    python: 'pip install -r requirements.txt',
+    ruby: 'bundle install',
+    go: 'go build -tags netgo -ldflags \'-s -w\' -o app',
+    rust: 'cargo build --release',
+    elixir: 'mix deps.get --only prod && MIX_ENV=prod mix compile'
+  };
   var RENDER_KEY_RE = /^rnd_[A-Za-z0-9]{16,128}$/;
   function planLabel(list, v) {
     var p = list.filter(function (x) { return x[0] === v; })[0] || list[0];
@@ -1894,6 +1906,8 @@ summary{min-height:24px;padding:3px 0;}
       q('f-renderRuntime').value = st.renderRuntime || 'node';
       var docker = q('f-renderRuntime').value === 'docker';
       q('renderBuildWrap').hidden = docker; q('renderStartWrap').hidden = docker;
+      // the runtime's usual build command until the owner types their own (task 1004464)
+      if (!st.renderBuildTouched) st.renderBuild = RENDER_BUILD_DEFAULTS[q('f-renderRuntime').value] || '';
       q('f-renderBuild').value = st.renderBuild || '';
       q('f-renderStart').value = st.renderStart || '';
       fillPlans(q('f-renderPlan'), RENDER_WEB_PLANS, st.renderPlan || 'starter');
@@ -1975,13 +1989,12 @@ summary{min-height:24px;padding:3px 0;}
       hooks.save(); syncNew();
     });
     q('renderNew').addEventListener('input', function (ev) {
-      if (ev.target.id === q('f-renderBuild').id) st.renderBuild = ev.target.value;
-      if (ev.target.id === q('f-renderStart').id) {
-        st.renderStart = ev.target.value;
-        // the "say how your app starts" ask is answered the moment there is a command —
-        // it used to stay on screen until the next press of Next
-        if (String(st.renderStart).trim() && /\berr\b/.test(q('h-render').className)) hint('h-render', '');
-      }
+      var typed = null;
+      if (ev.target.id === q('f-renderBuild').id) { st.renderBuild = ev.target.value; st.renderBuildTouched = true; typed = st.renderBuild; }
+      if (ev.target.id === q('f-renderStart').id) { st.renderStart = ev.target.value; typed = st.renderStart; }
+      // a "say how your app starts / is built" ask is answered the moment that box has a
+      // command — it used to stay on screen until the next press of Next
+      if (typed != null && String(typed).trim() && /\berr\b/.test(q('h-render').className)) hint('h-render', '');
       hooks.save();
     });
     function validate() {
@@ -1993,6 +2006,7 @@ summary{min-height:24px;padding:3px 0;}
       if (st.renderMode === 'adopt') {
         if (!services.some(function (s) { return s.id === st.renderServiceId && repoOf(s.repo) === repo().toLowerCase(); })) return bad('Choose the app to link, or create a new one.');
       } else if (st.renderMode === 'greenfield') {
+        if ((st.renderRuntime || 'node') !== 'docker' && !String(st.renderBuild || '').trim()) return bad('Say how your app is built — Render needs a build command, for example “npm install”.');
         if ((st.renderRuntime || 'node') !== 'docker' && !String(st.renderStart || '').trim()) return bad('Say how your app starts — the command Render should run, for example “npm start”.');
       } else return bad('Choose whether to create a new app or link one you already run.');
       hint('h-render', '');

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.38",
+  "version": "1.20.39",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.20.38",
+      "version": "1.20.39",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.38",
+  "version": "1.20.39",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -8333,5 +8333,15 @@
     {
       "text": "Builders on any Cloud Bongos project can now send feedback about Bongos itself with one command, and it arrives with the Bongos team as a task waiting for approval."
     }
+  ],
+  "1.20.39": [
+    {
+      "id": "1004465",
+      "text": "A version preview that cannot read its data now fails with the child's own output shown, and stopping it really removes its copy."
+    },
+    {
+      "id": "1004464",
+      "text": "Setting up an app on Render from the project wizard no longer fails when the owner leaves the build command empty. The box now comes filled in with Render's usual build command for the chosen language, which the owner can chan"
+    }
   ]
 }

package/scripts/gds/provision-render.js

@@ -117,6 +117,18 @@ async function greenfield(api, inst, host, deps) {
   return { ok: true };
 }
 
+// The owner reads this reason on the setup screen (app-status.js oneSentence). A refusal
+// from Render's API used to arrive as its raw line — "Render POST /services failed: …" —
+// so an answer from Render is re-said as a sentence with Render's own reason kept whole
+// (task 1004464). Anything else is already the leg's own words.
+function plainReason(e) {
+  const msg = e && e.message ? e.message : String(e);
+  const said = e && e.status != null && e.body && typeof e.body.message === 'string' ? e.body.message.trim() : '';
+  if (said) return `Render would not set up the app: ${said}`;
+  const m = /^Render (?:GET|POST|PATCH|PUT|DELETE) \S+ failed: ([\s\S]+)$/.exec(msg);
+  return m ? `Render would not set up the app: ${m[1].trim()}` : msg;
+}
+
 async function renderStandupInstance(inst, deps, intent) {
   const { db, log } = deps;
   const secretBox = deps.secretBox || require('../../src/bongos/secret-box');
@@ -137,7 +149,7 @@ async function renderStandupInstance(inst, deps, intent) {
 
     return host.mode === 'adopt' ? await adopt(api, inst, host, deps) : await greenfield(api, inst, host, deps);
   } catch (e) {
-    return refuse(e && e.message ? e.message : String(e));
+    return refuse(plainReason(e));
   } finally {
     if (intent && intent.id != null) await clearBorrowedKey(db, intent.id);
   }

package/scripts/gds/render-payload.js

@@ -21,7 +21,7 @@
 'use strict';
 
 // The vocabulary lives with the web tier's validation, so the two can never disagree.
-const { WEB_PLANS, DB_PLANS, REGIONS, RUNTIMES } = require('../../modules/provisioning/render-standup.js');
+const { WEB_PLANS, DB_PLANS, REGIONS, RUNTIMES, BUILD_DEFAULTS } = require('../../modules/provisioning/render-standup.js');
 const DEFAULTS = Object.freeze({ webPlan: 'starter', dbPlan: 'basic_256mb', region: 'virginia' });
 
 // A Render resource name from the project's slug. Render allows letters, digits and
@@ -47,14 +47,15 @@ function plansFor(appHost) {
 }
 
 // How the app is built and started, as the owner said. `docker` builds the repository's
-// own Dockerfile and needs no commands; every other runtime needs a start command, and a
-// build command if the app has a build step.
+// own Dockerfile and needs no commands; every other runtime needs a start command AND a
+// build command — Render refuses a native service without one (task 1004464), so a row
+// saved with none (including every row from before that fix) gets the runtime's default.
 function buildFor(appHost) {
   const h = appHost || {};
   if (!RUNTIMES.includes(h.runtime)) throw new Error(`unknown Render runtime '${h.runtime || 'none'}'`);
   if (h.runtime === 'docker') return { runtime: 'docker' };
   if (!h.startCommand) throw new Error('the app needs a start command');
-  return { runtime: h.runtime, buildCommand: h.buildCommand || null, startCommand: h.startCommand };
+  return { runtime: h.runtime, buildCommand: h.buildCommand || BUILD_DEFAULTS[h.runtime], startCommand: h.startCommand };
 }
 
 // POST /postgres. `plan` is never 'free' — see the header.
@@ -68,7 +69,7 @@ function renderPostgresPayload(inst, { ownerId, dbPlan, region }) {
 function renderServicePayload(inst, { ownerId, repoUrl, branch, webPlan, region, build, dbUrl }) {
   const envSpecificDetails = build.runtime === 'docker'
     ? {}
-    : { ...(build.buildCommand ? { buildCommand: build.buildCommand } : {}), startCommand: build.startCommand };
+    : { buildCommand: build.buildCommand, startCommand: build.startCommand };
   return {
     type: 'web_service',
     name: resourceName(inst),

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.20.38'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.20.39'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/npm_release_preview_commands.mjs

@@ -52,7 +52,7 @@ test('the copy is a custom-format dump of the live database, restored with no ow
 
 test('the copy is created empty and dropped if it is already there', () => {
   assert.deepEqual(c.createDbCommand(), { cmd: 'createdb', args: [PREVIEW_DB] });
-  assert.deepEqual(c.dropDbCommand(), { cmd: 'dropdb', args: ['--if-exists', PREVIEW_DB] });
+  assert.deepEqual(c.dropDbCommand(), { cmd: 'dropdb', args: ['--if-exists', '--force', PREVIEW_DB] });
 });
 
 test('the install is one version of the core into its own directory, production dependencies only', () => {

package/tests/npm_release_preview_diagnosis.mjs

@@ -0,0 +1,376 @@
+// tests/npm_release_preview_diagnosis.mjs — a preview that cannot serve data must say so (task 1004465).
+//
+// WHAT WENT WRONG LIVE. The first real preview started, answered /healthz, was reported
+// running, and then returned 500 on every page; the child's output went nowhere (stdio
+// 'ignore'), so nobody could say why. Stopping it left the copy database behind, because the
+// child was killed without waiting and the failed dropdb was ignored. These tests pin the four
+// repairs: the child's output is kept and redacted, the health check proves data can be read,
+// a stop waits for the child before dropping, and a drop that fails is reported, never idle.
+// Every spawn, command, probe, clock and file is injected.
+//
+// Run:  node --test tests/npm_release_preview_diagnosis.mjs
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { EventEmitter } from 'node:events';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const { createSupervisor, copyInstance } = require('../modules/npm-release/preview/supervisor.js');
+const cmds = require('../modules/npm-release/preview/commands.js');
+const { createChildLog, redact, secretValues } = require('../modules/npm-release/preview/childlog.js');
+const { probeHealth } = require('../modules/npm-release/preview/runtime.js');
+const { PREVIEW_DB, buildPreviewEnv } = require('../modules/npm-release/preview/env.js');
+
+const fwd = (x) => String(x).split(String.fromCharCode(92)).join('/');
+// Secret-shaped strings assembled at run time, so no scanner mistakes this file for a leak.
+const FAKE_GH = ['gh', 'p_', 'abcdefghijklmnopqrstuvwxyz0123'].join('');
+const FAKE_URL = ['post', 'gres://svc:pw9999@db/x'].join('');
+
+// `sleepMode`: 'instant' returns at once (the health loop's waits); 'never' returns only for
+// waits under a second, so a stop can be released ONLY by the child's real exit.
+function rig({ probe = async () => true, failRun = () => false, killBehaviour = 'exit', sleepMode = 'instant', instanceRoot = null, env, liveDb = 'live_db', copy } = {}) {
+  const events = [];
+  const calls = [];
+  const fake = { spawned: [], rm: [] };
+  const sup = createSupervisor({
+    run: async (cmd) => {
+      calls.push(cmd);
+      events.push(cmd.cmd);
+      return failRun(cmd) ? { code: 3, stderr: 'boom from ' + cmd.cmd } : { code: 0, stderr: '' };
+    },
+    spawn: (bin, args, opts) => {
+      const child = new EventEmitter();
+      child.stdout = new EventEmitter();
+      child.stderr = new EventEmitter();
+      child.bin = bin; child.args = args; child.opts = opts;
+      child.kill = (sig) => {
+        events.push('kill:' + sig);
+        if (killBehaviour === 'exit') setImmediate(() => { events.push('exit'); child.emit('exit', 0); });
+        if (killBehaviour === 'on-sigkill' && sig === 'SIGKILL') setImmediate(() => { events.push('exit'); child.emit('exit', null); });
+      };
+      fake.spawned.push(child);
+      return child;
+    },
+    probe,
+    sleep: (ms) => (sleepMode === 'instant' || ms < 1000 ? Promise.resolve() : sleepMode === 'short' ? new Promise((r) => setTimeout(r, 10)) : new Promise(() => {})),
+    now: () => 1_000_000,
+    fsImpl: { mkdtempSync: (p) => p + 'XYZ', mkdirSync() {}, rmSync: (p) => fake.rm.push(p), writeFile() {}, existsSync: () => false, readFileSync: () => { throw new Error('none'); } },
+    tmpdir: '/tmp', liveDb, cacheRoot: '/cache', port: 3190, instanceRoot, copy,
+    env: env || { PATH: '/bin' },
+  });
+  return { sup, events, calls, fake };
+}
+
+// ---- the child's output: kept, capped, redacted ---------------------------------------
+
+test('what the child printed is kept and shown when the preview cannot serve data', async () => {
+  const r = rig({
+    env: { PATH: '/bin', PGPASSWORD: 'hunter2pass', GITHUB_TOKEN: FAKE_GH },
+    probe: async () => {
+      r.fake.spawned[0].stderr.emit('data', 'error: relation "builders" does not exist\n');
+      r.fake.spawned[0].stdout.emit('data', `connecting with password=abc123 to ${FAKE_URL} using hunter2pass and ${FAKE_GH}\n`);
+      return { ok: false, reason: 'a database-backed read (/api/bongos/me) answered 500' };
+    },
+  });
+  await r.sup.start('1.19.1000').done;
+  const s = r.sup.status();
+  assert.equal(s.state, 'failed');
+  const tail = s.log_tail.join('\n');
+  assert.match(tail, /relation "builders" does not exist/);
+  assert.match(s.error, /Its last output:.*relation "builders" does not exist/);
+  for (const secret of ['hunter2pass', 'abc123', 'pw9999', FAKE_GH]) {
+    assert.ok(!tail.includes(secret), 'the tail leaks a secret');
+    assert.ok(!s.error.includes(secret), 'the error leaks a secret');
+  }
+});
+
+test('the tail is at most twenty lines and each line is short', () => {
+  const lg = createChildLog({});
+  lg.append(Array.from({ length: 50 }, (_, i) => 'line ' + i).join('\n') + '\n' + 'x'.repeat(1000) + '\n');
+  const t = lg.tail();
+  assert.equal(t.length, 20);
+  assert.ok(t.every((l) => l.length <= 301));
+});
+
+test('the log is capped, keeping the newest output', () => {
+  const lg = createChildLog({ cap: 100 });
+  lg.append('a'.repeat(500));
+  lg.append('THE-END');
+  assert.ok(lg.size() <= 100);
+  assert.match(lg.tail().join('\n'), /THE-END$/);
+});
+
+test('redaction takes out listed values and the common secret shapes', () => {
+  const secrets = secretValues({ SESSION_SECRET: 'sekrit-value-1', NOT_ONE: 'visible-value', PGPASSWORD: 'p' });
+  assert.deepEqual(secrets, ['sekrit-value-1'], 'only secret-named, long-enough values');
+  const out = redact(`x sekrit-value-1 y Bearer abc.def-ghi ${FAKE_URL} token=zzz visible-value`, secrets);
+  assert.ok(!/sekrit-value-1|abc\.def|pw9999|zzz/.test(out), out);
+  assert.match(out, /visible-value/);
+});
+
+test('the log is also written to a file in the scratch directory, and a failing disk does not matter', () => {
+  const writes = [];
+  const lg = createChildLog({ fsImpl: { writeFile: (f, b, cb) => { writes.push([f, b]); cb(); } }, file: '/tmp/x/preview.log', flushMs: 1e6 });
+  lg.append('hello');
+  lg.flush();
+  assert.deepEqual(writes, [['/tmp/x/preview.log', 'hello']]);
+  lg.close();
+  const broken = createChildLog({ fsImpl: { writeFile() { throw new Error('disk'); } }, file: '/f', flushMs: 1e6 });
+  broken.append('still fine');
+  assert.doesNotThrow(() => broken.flush());
+  broken.close();
+});
+
+test('a burst of output costs one asynchronous write, never one write per chunk, and none after close', async () => {
+  const writes = [];
+  const lg = createChildLog({ fsImpl: { writeFile: (f, b, cb) => { writes.push(b); cb(); } }, file: '/f', flushMs: 5 });
+  for (let i = 0; i < 500; i++) lg.append('line ' + i + '\n');
+  assert.equal(writes.length, 0, 'nothing is written inside the data handler');
+  await new Promise((r) => setTimeout(r, 40));
+  assert.equal(writes.length, 1, 'the burst was written once');
+  assert.match(writes[0], /line 499/);
+  lg.append('after');
+  lg.close();
+  await new Promise((r) => setTimeout(r, 40));
+  assert.equal(writes.length, 1, 'closing cancels a pending write');
+});
+
+// ---- ready means it can serve data ----------------------------------------------------
+
+test('a probe that sees a database failure fails the preview, says why, and cleans up', async () => {
+  const { sup, events, fake, calls } = rig({ probe: async () => ({ ok: false, reason: '/version reports schemaPending null: the database copy could not be read' }) });
+  await sup.start('1.19.1000').done;
+  const s = sup.status();
+  assert.equal(s.state, 'failed');
+  assert.match(s.error, /could not serve data/);
+  assert.match(s.error, /schemaPending null/);
+  assert.ok(events.includes('kill:SIGTERM'), 'the child was stopped');
+  assert.deepEqual(calls[calls.length - 1], cmds.dropDbCommand(), 'the copy was dropped');
+  assert.equal(fake.rm.length, 1, 'the scratch directory was removed');
+});
+
+test('a preview is running only once the probe says it can serve data', async () => {
+  const answers = [{ ok: false, reason: 'warming up' }, { ok: false, reason: 'warming up' }, { ok: true }];
+  const { sup } = rig({ probe: async () => answers.shift() });
+  await sup.start('1.19.1000').done;
+  assert.equal(sup.status().state, 'running');
+});
+
+test('a bare true from the probe still counts as healthy (older callers)', async () => {
+  const { sup } = rig({ probe: async () => true });
+  await sup.start('1.19.1000').done;
+  assert.equal(sup.status().state, 'running');
+});
+
+test('a child that exits while starting fails the start at once, with its output', async () => {
+  let probes = 0;
+  const r = rig({
+    probe: async () => {
+      probes += 1;
+      r.fake.spawned[0].stderr.emit('data', 'Error: Cannot find module "./nope"\n');
+      r.fake.spawned[0].emit('exit', 1);
+      return false;
+    },
+  });
+  await r.sup.start('1.19.1000').done;
+  assert.equal(probes, 1, 'it did not keep probing a dead child');
+  assert.match(r.sup.status().error, /exited \(1\) before it could serve data/);
+  assert.match(r.sup.status().error, /Cannot find module/);
+  assert.equal(r.sup.status().state, 'failed');
+});
+
+// ---- the probe itself ------------------------------------------------------------------
+
+function fakeGet(map) {
+  return async (port, p) => map[p] || { error: 'refused' };
+}
+const HEALTHZ = { status: 200, body: '{}' };
+const OK = { status: 200, body: '{"coreVersion":"1.19.1000","schemaPending":0}' };
+
+test('the probe passes only when healthz, /version and a database-backed read all answer', async () => {
+  const r = await probeHealth(3190, fakeGet({ '/healthz': HEALTHZ, '/version': OK, '/api/bongos/me': { status: 401, body: '{}' } }));
+  assert.deepEqual(r, { ok: true });
+});
+
+test('schemaPending null (the database read failed) fails the probe even though /healthz is 200', async () => {
+  const r = await probeHealth(3190, fakeGet({ '/healthz': HEALTHZ, '/version': { status: 200, body: '{"schemaPending":null,"commit":null}' }, '/api/bongos/me': { status: 401, body: '' } }));
+  assert.equal(r.ok, false);
+  assert.match(r.reason, /schemaPending null/);
+});
+
+test('a 500 from a database-backed route fails the probe', async () => {
+  const r = await probeHealth(3190, fakeGet({ '/healthz': HEALTHZ, '/version': OK, '/api/bongos/me': { status: 500, body: '' } }));
+  assert.equal(r.ok, false);
+  assert.match(r.reason, /\/api\/bongos\/me\) answered 500/);
+});
+
+test('a version too old to report schemaPending is judged by the database-backed read alone', async () => {
+  const old = { status: 200, body: '{"coreVersion":"1.0.1"}' };
+  const good = await probeHealth(3190, fakeGet({ '/healthz': HEALTHZ, '/version': old, '/api/bongos/me': { status: 401, body: '' } }));
+  assert.equal(good.ok, true);
+  const bad = await probeHealth(3190, fakeGet({ '/healthz': HEALTHZ, '/version': old, '/api/bongos/me': { status: 500, body: '' } }));
+  assert.equal(bad.ok, false);
+});
+
+test('nothing answering, or /healthz not 200, fails the probe', async () => {
+  assert.equal((await probeHealth(3190, fakeGet({}))).ok, false);
+  assert.equal((await probeHealth(3190, fakeGet({ '/healthz': { status: 503, body: '' } }))).ok, false);
+});
+
+// ---- the child's working directory is an instance --------------------------------------
+
+test('the child runs in a scratch instance holding the live config, and is told so', async () => {
+  const copied = [];
+  const { sup, fake, calls } = rig({ instanceRoot: '/live/root', copy: (o) => copied.push([o.from, fwd(o.to)]) });
+  await sup.start('1.19.1000').done;
+  assert.deepEqual(copied, [['/live/root', '/tmp/bongos-preview-XYZ/instance']]);
+  const child = fake.spawned[0];
+  assert.equal(fwd(child.opts.cwd), '/tmp/bongos-preview-XYZ/instance');
+  assert.equal(fwd(child.opts.env.BONGOS_INSTANCE_ROOT), '/tmp/bongos-preview-XYZ/instance');
+  const migrate = calls.find((c) => c.cmd === 'bash');
+  assert.equal(fwd(migrate.cwd), '/tmp/bongos-preview-XYZ/instance');
+  assert.equal(fwd(migrate.env.INIT_CWD), '/tmp/bongos-preview-XYZ/instance');
+  assert.equal(migrate.env.PGDATABASE, PREVIEW_DB);
+});
+
+test('without an instance root the child still runs from its install directory', async () => {
+  const { sup, fake } = rig();
+  await sup.start('1.19.1000').done;
+  assert.equal(fwd(fake.spawned[0].opts.cwd), '/cache/1.19.1000');
+  assert.equal(fake.spawned[0].opts.env.BONGOS_INSTANCE_ROOT, undefined);
+});
+
+test('copying the instance takes the boot packs and instance migrations, and nothing else from config', () => {
+  const from = fs.mkdtempSync(path.join(os.tmpdir(), 'pv-from-'));
+  const to = fs.mkdtempSync(path.join(os.tmpdir(), 'pv-to-'));
+  try {
+    fs.mkdirSync(path.join(from, 'config'));
+    fs.mkdirSync(path.join(from, 'migrations', 'instance'), { recursive: true });
+    fs.writeFileSync(path.join(from, 'config', 'branding.json'), '{"envPrefix":"ACME"}');
+    fs.writeFileSync(path.join(from, 'config', 'modules.json'), '{}');
+    // files that are not on the allow-list stay behind whatever they are called
+    for (const name of ['go-live.json', 'push-token.json', 'apikey.json', 'db-creds.json', 'notes.txt']) fs.writeFileSync(path.join(from, 'config', name), '{}');
+    fs.writeFileSync(path.join(from, 'migrations', 'instance', '0001_x.sql'), 'select 1;');
+    copyInstance({ fsImpl: fs, from, to });
+    assert.deepEqual(fs.readdirSync(path.join(to, 'config')).sort(), ['branding.json', 'modules.json']);
+    assert.deepEqual(fs.readdirSync(path.join(to, 'migrations', 'instance')), ['0001_x.sql']);
+    // an instance with neither directory is not an error
+    copyInstance({ fsImpl: fs, from: path.join(from, 'nowhere'), to });
+  } finally {
+    fs.rmSync(from, { recursive: true, force: true });
+    fs.rmSync(to, { recursive: true, force: true });
+  }
+});
+
+test('the module switches cover every env prefix the core resolves (a tripwire against drift)', () => {
+  const ic = require('../src/instance-config');
+  const { MODULES_OFF } = require('../modules/npm-release/preview/env.js');
+  for (const pfx of [ic.FALLBACK_ENV_PREFIX, ...ic.LEGACY_ENV_PREFIXES]) {
+    assert.ok(MODULES_OFF.includes(pfx + '_MODULE_DISCORD'), 'no switch under the ' + pfx + ' prefix: a prefix the core reads would leave the module on');
+  }
+});
+
+test('the module switches are set under every prefix, including the copied instance own', () => {
+  const env = buildPreviewEnv({ port: 3190, scratchHome: '/h', instanceRoot: '/i', envPrefix: 'ACME' });
+  for (const pfx of ['BONGOS', 'CLOUDBONGOS', 'OTB', 'GDS', 'PMS', 'ACME']) {
+    assert.equal(env[pfx + '_MODULE_DISCORD'], '0', pfx);
+    assert.equal(env[pfx + '_MODULE_AGENTS'], '0', pfx);
+  }
+  assert.equal(buildPreviewEnv({ port: 1, scratchHome: '/h', envPrefix: 'bad prefix; rm' }).ACME_MODULE_DISCORD, undefined);
+});
+
+// ---- stopping really drops the copy ------------------------------------------------------
+
+test('stop waits for the child to exit before it drops the copy', async () => {
+  // sleepMode "never": nothing but the child's own exit can let the stop go on.
+  const { sup, events } = rig({ sleepMode: 'never' });
+  await sup.start('1.19.1000').done;
+  events.length = 0;
+  await sup.stop();
+  assert.deepEqual(events, ['kill:SIGTERM', 'exit', 'dropdb']);
+  assert.equal(sup.status().state, 'idle');
+});
+
+test('a child that ignores SIGTERM is killed with SIGKILL before the drop', async () => {
+  const { sup, events } = rig({ killBehaviour: 'on-sigkill', sleepMode: 'short' });
+  await sup.start('1.19.1000').done;
+  events.length = 0;
+  await sup.stop();
+  assert.deepEqual(events, ['kill:SIGTERM', 'kill:SIGKILL', 'exit', 'dropdb']);
+});
+
+test('a failed dropdb is retried after ending the copy backends, then reported instead of idle', async () => {
+  let failing = false;
+  const { sup, calls } = rig({ failRun: (c) => failing && c.cmd === 'dropdb' });
+  await sup.start('1.19.1000').done;
+  failing = true;
+  calls.length = 0;
+  const s = await sup.stop();
+  assert.deepEqual(calls.map((c) => c.cmd), ['dropdb', 'psql', 'dropdb']);
+  assert.equal(calls[0].args.includes('--force'), true);
+  assert.equal(calls[2].args.includes('--force'), false, 'the retry is plain');
+  assert.equal(s.state, 'failed');
+  assert.equal(s.stage, 'drop');
+  assert.match(s.error, /could not be dropped/);
+  assert.equal(sup.status().state, 'failed', 'and it stays reported until a drop works');
+});
+
+test('a dropdb that fails only for want of --force is rescued by the fallback', async () => {
+  let forceFails = false;
+  const { sup } = rig({ failRun: (c) => forceFails && c.cmd === 'dropdb' && c.args.includes('--force') });
+  await sup.start('1.19.1000').done;
+  forceFails = true;
+  const s = await sup.stop();
+  assert.equal(s.state, 'idle');
+});
+
+test('a failed start whose copy will not drop says both things', async () => {
+  let dropsFail = false;
+  const { sup } = rig({
+    probe: async () => { dropsFail = true; return { ok: false, reason: 'the data path is broken' }; },
+    failRun: (c) => dropsFail && c.cmd === 'dropdb',
+  });
+  await sup.start('1.19.1000').done;
+  const s = sup.status();
+  assert.equal(s.state, 'failed');
+  assert.match(s.error, /the data path is broken/);
+  assert.match(s.error, /could not be dropped/);
+});
+
+// ---- the drop can never name the live database ---------------------------------------------
+
+test('a supervisor whose live database is the preview name cannot be built', () => {
+  assert.throws(() => rig({ liveDb: PREVIEW_DB }), /cannot be named bongos_preview/);
+});
+
+test('every drop command names the fixed copy, and nothing else passes the guard', () => {
+  for (const c of [cmds.dropDbCommand(), cmds.dropDbPlainCommand(), cmds.terminateBackendsCommand()]) {
+    assert.equal(cmds.targetsOnlyPreviewDb(c), true, JSON.stringify(c));
+    assert.ok(JSON.stringify(c).includes(PREVIEW_DB));
+  }
+  for (const bad of [
+    { cmd: 'dropdb', args: ['--if-exists', 'live_db'] },
+    { cmd: 'dropdb', args: ['live_db', PREVIEW_DB] },
+    { cmd: 'dropdb', args: ['--if-exists', '--force', 'live_db'] },
+    { cmd: 'psql', args: ['-d', 'postgres', '-c', 'DROP DATABASE live_db'] },
+    { cmd: 'psql', args: ['-X', '-d', 'postgres', '-tAc', "SELECT pg_terminate_backend(pid) FROM pg_stat_activity WHERE datname = 'live_db'"] },
+    { cmd: 'bash', args: ['-c', 'dropdb ' + PREVIEW_DB] },
+    null,
+  ]) assert.equal(cmds.targetsOnlyPreviewDb(bad), false, JSON.stringify(bad));
+  assert.match(cmds.terminateBackendsCommand().args.join(' '), /datname = 'bongos_preview' AND pid <> pg_backend_pid\(\)/);
+});
+
+test('every drop-capable command a start and stop runs is the guarded kind, none naming the live database', async () => {
+  const { sup, calls } = rig({ failRun: (c) => c.cmd === 'dropdb' });
+  await sup.start('1.19.1000').done;
+  await sup.stop();
+  const risky = calls.filter((x) => x.cmd === 'dropdb' || x.cmd === 'psql');
+  assert.ok(risky.length > 0);
+  for (const c of risky) {
+    assert.equal(cmds.targetsOnlyPreviewDb(c), true, JSON.stringify(c));
+    assert.ok(!JSON.stringify(c.args).includes('live_db'));
+  }
+});

package/tests/npm_release_preview_supervisor.mjs

@@ -28,7 +28,7 @@ function rig({ failOn, probeResults, env } = {}) {
     },
     spawn: (bin, args, opts) => {
       const handlers = {};
-      const child = { bin, args, opts, on: (ev, fn) => { handlers[ev] = fn; }, kill: () => { fake.killed += 1; }, emit: (ev, ...a) => handlers[ev] && handlers[ev](...a) };
+      const child = { bin, args, opts, on: (ev, fn) => { handlers[ev] = fn; }, kill: (sig) => { fake.killed += 1; (fake.signals ||= []).push(sig); if (handlers.exit) handlers.exit(0); }, emit: (ev, ...a) => handlers[ev] && handlers[ev](...a) };
       fake.spawned.push(child);
       return child;
     },
@@ -46,7 +46,7 @@ function rig({ failOn, probeResults, env } = {}) {
 }
 
 const fwd = (x) => String(x).split(String.fromCharCode(92)).join('/');
-const DROP = { cmd: 'dropdb', args: ['--if-exists', PREVIEW_DB] };
+const DROP = { cmd: 'dropdb', args: ['--if-exists', '--force', PREVIEW_DB] };
 
 test('a start runs install, copy, restore and migrate, in that order, then launches and waits for health', async () => {
   const { sup, calls, fake } = rig();
@@ -89,9 +89,9 @@ for (const failOn of ['npm', 'dropdb', 'createdb', 'dump', 'pg_restore', 'bash']
     await sup.start('1.19.1000').done;
     const s = sup.status();
     assert.equal(s.state, 'failed');
-    assert.match(s.error, /failed \(exit 3\)/);
+    assert.match(s.error, failOn === 'dropdb' ? /could not be dropped/ : /failed [(]exit 3[)]/);
     assert.equal(fake.spawned.length, 0, 'no process was started');
-    assert.deepEqual(calls[calls.length - 1], DROP, 'the copy is dropped last');
+    if (failOn !== 'dropdb') assert.deepEqual(calls[calls.length - 1], DROP, 'the copy is dropped last');
     assert.equal(rmCalls.length, 1, 'the scratch directory is removed');
   });
 }