@bongos/core 1.20.38 → 1.20.40

package/modules/npm-release/preview/supervisor.js

@@ -1,29 +1,44 @@
 'use strict';
 
 // modules/npm-release/preview/supervisor.js — starts, watches and stops the ONE version
-// preview this hall may run (task 1004300, ADR 0349).
+// preview this hall may run (task 1004300, ADR 0349; hardened by task 1004465).
 //
 // A preview is a second Bongos process, running an installed copy of an older core against
 // a COPY of the live database, reached through the live hall's own address (divert.js). This
 // file owns its lifecycle and nothing else: install → copy the database → migrate → launch →
-// wait until it answers. Every outward step goes through an injected function (run for a
-// command, spawn for the long-lived child, probe for the health check, sleep, now), which is
+// wait until it can serve data. Every outward step goes through an injected function (run for
+// a command, spawn for the long-lived child, probe for the health check, sleep, now), which is
 // what lets the whole lifecycle be tested without a process, a database or a network.
 //
 // ONE AT A TIME, STOPPED WHEN IDLE. A second preview is refused, not queued; a running one
 // that nothing has touched for IDLE_MS is stopped and its copy of the database dropped. That
 // bound is what keeps a preview from becoming a permanent second tenant of the droplet.
+//
+// THREE THINGS task 1004465 ADDED, each from the first live run:
+//   * the child's output is kept (redacted, capped) and shown when a start fails;
+//   * "running" means the child can serve DATA, not merely that it answers /healthz;
+//   * a stop waits for the child to exit and really drops the copy, or says it could not.
 
 const os = require('node:os');
 const fs = require('node:fs');
 const path = require('node:path');
-const { buildPreviewEnv } = require('./env');
+const { buildPreviewEnv, PREVIEW_DB } = require('./env');
 const cmds = require('./commands');
+const { createChildLog, redact, secretValues } = require('./childlog');
 
 const IDLE_MS = 20 * 60 * 1000;
 const DEFAULT_PORT = 3190;
 const HEALTH_TRIES = 40;
 const HEALTH_INTERVAL_MS = 1500;
+// How long a stopping child gets to exit on SIGTERM before SIGKILL, and how long after that.
+const KILL_WAIT_MS = 5000;
+const KILL_FINAL_WAIT_MS = 2000;
+
+// The ONLY files of the live instance's config/ copied into the preview's scratch instance:
+// the identity and switch packs a hall reads at boot. An allow-list, like the environment
+// (env.js): a deny-list forgets the next credential file someone adds, an allow-list cannot.
+// Anything else in config/ (go-live.json, key files, whatever comes next) stays behind.
+const CONFIG_COPY = /^(branding|modules|government|ideas|design-tokens)(\.neutral)?\.json$/;
 
 // How far behind the running version a preview may reach, counted in PUBLISHED versions.
 const WINDOW = 30;
@@ -52,43 +67,123 @@ function previewable(version, { published, running, window = WINDOW } = {}) {
   return { ok: true };
 }
 
+/**
+ * Copy the live instance's host content the child needs to boot as an instance rather than
+ * as a bare install: config/ (branding, module switches, government) and migrations/instance/.
+ * A source that is absent is skipped; any other failure fails the start. Only the allow-listed
+ * pack files of config/ are copied (CONFIG_COPY).
+ */
+function copyInstance({ fsImpl, from, to }) {
+  const parts = [
+    // The directory itself always passes the filter; files are copied only when allow-listed.
+    ['config', (src) => path.basename(src) === 'config' || CONFIG_COPY.test(path.basename(src))],
+    [path.join('migrations', 'instance'), () => true],
+  ];
+  for (const [rel, filter] of parts) {
+    const src = path.join(from, rel);
+    try {
+      if (!fsImpl.existsSync(src)) continue;
+      fsImpl.mkdirSync(path.dirname(path.join(to, rel)), { recursive: true });
+      fsImpl.cpSync(src, path.join(to, rel), { recursive: true, filter });
+    } catch (e) {
+      throw new Error(`could not copy the instance ${rel} into the preview: ${e && e.message}`);
+    }
+  }
+}
+
 /**
  * @param {object} o
  * @param {Function} o.run    (command) => Promise of { code, stderr } — runs one command to the end
  * @param {Function} o.spawn  node:child_process spawn (the long-lived child)
- * @param {Function} o.probe  (port) => Promise of boolean — does the preview answer its health check
+ * @param {Function} o.probe  (port) => Promise of boolean | { ok, reason } — can the preview serve data
  * @param {string} o.liveDb   the live database name (the source of the copy)
  * @param {string} o.cacheRoot  where versions are installed
+ * @param {string} [o.instanceRoot]  the live instance's root; its config/ and migrations/instance/
+ *                           are copied into the preview's scratch instance directory
  * @param {object} [o.env]    the live environment (read by buildPreviewEnv only)
  */
 function createSupervisor({
-  run, spawn, probe, liveDb, cacheRoot,
-  env = process.env, port = DEFAULT_PORT,
+  run, spawn, probe, liveDb, cacheRoot, instanceRoot = null,
+  env = process.env, port = DEFAULT_PORT, killWaitMs = KILL_WAIT_MS,
   now = Date.now, sleep = (ms) => new Promise((r) => setTimeout(r, ms)),
   fsImpl = fs, tmpdir = os.tmpdir(), idleMs = IDLE_MS,
   log = { info() {}, warn() {}, error() {} },
+  copy = copyInstance,
 } = {}) {
+  // The one database a drop may ever name is the fixed copy. If the live database WERE that
+  // name, every stop would drop the live hall's data, so refuse to be built at all.
+  if (liveDb === PREVIEW_DB) throw new Error(`the live database cannot be named ${PREVIEW_DB}: that name is the preview's copy and is dropped on every stop`);
+
   let state = { state: 'idle', version: null, stage: null, error: null, startedAt: null, lastTouch: null };
   let child = null;
   let workDir = null;
+  let childLog = null;     // the running or just-stopped child's output
+  let keptTail = [];       // its tail, kept after the scratch directory is gone
+  let secrets = secretValues(env);
+  let exitInfo = null;     // { code } once the child has exited
+  let exited = Promise.resolve();
 
   const set = (patch) => { state = { ...state, ...patch }; };
-  const status = () => ({ ...state, port, idle_ms: idleMs });
+  const status = () => ({ ...state, port, idle_ms: idleMs, log_tail: childLog ? childLog.tail() : keptTail });
 
   async function step(stage, command) {
     set({ stage });
     const r = await run(command);
     if (!r || r.code !== 0) {
-      const tail = r && r.stderr ? `: ${String(r.stderr).trim().slice(-300)}` : '';
+      const tail = r && r.stderr ? `: ${redact(String(r.stderr).trim().slice(-300), secrets)}` : '';
       throw new Error(`${stage} failed (exit ${r ? r.code : '?'})${tail}`);
     }
   }
 
+  // Run a command only if it can touch nothing but the copy. Never throws for a failed command.
+  async function runDrop(command) {
+    if (!cmds.targetsOnlyPreviewDb(command)) throw new Error(`refusing a database command that does not name only ${PREVIEW_DB}`);
+    try { return (await run(command)) || { code: -1, stderr: 'no result' }; } catch (e) { return { code: -1, stderr: e && e.message }; }
+  }
+
+  /**
+   * Drop the copy, really. dropdb --force first (it ends stray connections itself); if that
+   * is refused, end the copy's connections — the copy's alone — and drop plainly. Returns
+   * null when the copy is gone, else a sentence saying it is not.
+   */
+  async function dropCopy() {
+    const first = await runDrop(cmds.dropDbCommand());
+    if (first.code === 0) return null;
+    await runDrop(cmds.terminateBackendsCommand());
+    const second = await runDrop(cmds.dropDbPlainCommand());
+    if (second.code === 0) return null;
+    const why = redact(String(second.stderr || first.stderr || '').trim().slice(-200), secrets);
+    return `the copy database ${PREVIEW_DB} could not be dropped (exit ${second.code})${why ? `: ${why}` : ''}`;
+  }
+
+  // Ask the child to stop and WAIT for it, then insist. The drop that follows needs the
+  // child's database connections gone; killing without waiting is what left the copy behind.
+  async function stopChild(c) {
+    if (exitInfo) return;
+    try { c.kill('SIGTERM'); } catch (e) { log.warn(`preview child would not stop: ${e && e.message}`); }
+    await Promise.race([exited, sleep(killWaitMs)]);
+    if (exitInfo) return;
+    try { c.kill('SIGKILL'); } catch { /* already gone */ }
+    await Promise.race([exited, sleep(KILL_FINAL_WAIT_MS)]);
+  }
+
   // Everything a start or a stop leaves behind: the child, the copy, the scratch directory.
+  // Returns null when all of it is gone, else the sentence saying the copy is not.
   async function cleanup() {
-    if (child) { try { child.kill(); } catch (e) { log.warn(`preview child would not stop: ${e && e.message}`); } child = null; }
-    try { await run(cmds.dropDbCommand()); } catch (e) { log.warn(`preview copy could not be dropped: ${e && e.message}`); }
+    const c = child;
+    child = null;
+    if (c) await stopChild(c);
+    if (childLog) { keptTail = childLog.tail(); childLog.close(); childLog = null; }
+    const dropError = await dropCopy();
+    if (dropError) log.error(`preview: ${dropError}`);
     if (workDir) { try { fsImpl.rmSync(workDir, { recursive: true, force: true }); } catch { /* best effort */ } workDir = null; }
+    return dropError;
+  }
+
+  // A few of the child's last lines, to sit in the error message itself.
+  function withTail(message, lg) {
+    const lines = lg ? lg.tail(5) : [];
+    return lines.length ? `${message}. Its last output: ${lines.join(' | ')}`.slice(0, 900) : message;
   }
 
   async function launch(version) {
@@ -97,41 +192,78 @@ function createSupervisor({
       const home = path.join(workDir, 'home');
       fsImpl.mkdirSync(home, { recursive: true });
       const dumpFile = path.join(workDir, 'live.dump');
-      const childEnv = buildPreviewEnv({ env, port, scratchHome: home });
+
+      // The child's working directory is a scratch INSTANCE: the live instance's config/ and
+      // migrations/instance/, copied. Run from the bare install directory it had no config/
+      // at all (no branding, no module switches) and was not shaped like a hall.
+      let instanceDir;
+      let prefix;
+      if (instanceRoot) {
+        instanceDir = path.join(workDir, 'instance');
+        fsImpl.mkdirSync(instanceDir, { recursive: true });
+        copy({ fsImpl, from: instanceRoot, to: instanceDir });
+        try { prefix = JSON.parse(fsImpl.readFileSync(path.join(instanceDir, 'config', 'branding.json'), 'utf8')).envPrefix; } catch { /* no branding pack: the default prefix */ }
+      }
+      const childEnv = buildPreviewEnv({ env, port, scratchHome: home, instanceRoot: instanceDir, envPrefix: prefix });
+      secrets = secretValues(env, childEnv);
+      keptTail = [];
+      childLog = createChildLog({ secrets, fsImpl, file: path.join(workDir, 'preview.log') });
+      exitInfo = null;
 
       await step('install', { ...cmds.installCommand({ cacheRoot, version }), env: childEnv });
-      await step('drop-old-copy', cmds.dropDbCommand());
+      set({ stage: 'drop-old-copy' });
+      const leftover = await dropCopy();
+      if (leftover) throw new Error(leftover);
       await step('create-copy', cmds.createDbCommand());
       await step('dump', cmds.dumpCommand({ liveDb, dumpFile }));
       await step('restore', cmds.restoreCommand({ dumpFile }));
-      await step('migrate', cmds.migrateCommand({ cacheRoot, version, env: childEnv }));
+      await step('migrate', cmds.migrateCommand({ cacheRoot, version, env: childEnv, instanceDir }));
 
       set({ stage: 'launch' });
-      child = spawn(process.execPath, [cmds.entryPath(cacheRoot, version)], {
-        cwd: cmds.versionDir(cacheRoot, version), env: childEnv, stdio: 'ignore',
+      // The child's output is kept (redacted, capped): its errors used to go nowhere.
+      const mine = childLog;
+      const spawned = spawn(process.execPath, [cmds.entryPath(cacheRoot, version)], {
+        cwd: instanceDir || cmds.versionDir(cacheRoot, version), env: childEnv, stdio: ['ignore', 'pipe', 'pipe'],
       });
-      child.on('exit', (code) => {
-        // A child that dies on its own must not leave a copy behind or a page waiting on it.
-        if (child && state.state === 'running') {
-          log.warn(`preview of ${version} exited (${code})`);
-          child = null;
-          set({ state: 'failed', stage: 'exited', error: `the preview process exited (${code})` });
-          cleanup();
-        }
+      child = spawned;
+      exited = new Promise((resolve) => {
+        spawned.on('exit', (code) => {
+          exitInfo = { code };
+          resolve();
+          // A child that dies on its own must not leave a copy behind or a page waiting on it.
+          if (child === spawned && state.state === 'running') {
+            log.warn(`preview of ${version} exited (${code})`);
+            set({ state: 'failed', stage: 'exited', error: withTail(`the preview process exited (${code})`, mine) });
+            cleanup().then((err) => { if (err) set({ error: `${state.error}; ${err}` }); });
+          }
+        });
       });
+      for (const stream of [spawned.stdout, spawned.stderr]) {
+        if (stream && typeof stream.on === 'function') stream.on('data', (d) => mine.append(String(d)));
+      }
 
       set({ stage: 'health' });
+      // READY MEANS IT CAN SERVE DATA. The probe must see the database and the auth path work,
+      // not just the process answer (probeHealth in runtime.js); a preview that cannot is
+      // failed here, with why, rather than reported running.
       let up = false;
+      let why = 'it did not answer';
       for (let i = 0; i < HEALTH_TRIES && !up; i++) {
-        up = await probe(port);
-        if (!up) await sleep(HEALTH_INTERVAL_MS);
+        if (exitInfo) throw new Error(withTail(`the preview process exited (${exitInfo.code}) before it could serve data`, mine));
+        const r = await probe(port);
+        up = r === true || !!(r && r.ok);
+        if (!up) {
+          if (r && r.reason) why = r.reason;
+          await sleep(HEALTH_INTERVAL_MS);
+        }
       }
-      if (!up) throw new Error('the preview did not answer in time');
+      if (!up) throw new Error(withTail(`the preview started but could not serve data (${why})`, mine));
       set({ state: 'running', stage: null, startedAt: now(), lastTouch: now() });
     } catch (e) {
       log.error(`preview of ${version} failed: ${e && e.message}`);
-      set({ state: 'failed', error: e && e.message ? e.message : String(e) });
-      await cleanup();
+      set({ state: 'failed', error: redact(e && e.message ? e.message : String(e), secrets) });
+      const dropError = await cleanup();
+      if (dropError) set({ error: `${state.error}; ${dropError}` });
     }
   }
 
@@ -146,13 +278,20 @@ function createSupervisor({
       if (state.version === version) return { ok: true, already: true, status: status(), done: Promise.resolve() };
       return { ok: false, code: 'preview_busy', status: status() };
     }
+    keptTail = [];
     set({ state: 'starting', version, stage: 'queued', error: null, startedAt: null, lastTouch: now() });
     return { ok: true, status: status(), done: launch(version) };
   }
 
   /** Stop the preview and drop its copy. Safe to call at any point. */
   async function stop() {
-    await cleanup();
+    const dropError = await cleanup();
+    // A copy that is still there is NOT idle: say so, where the deploy page will show it.
+    if (dropError) {
+      set({ state: 'failed', stage: 'drop', error: dropError, startedAt: null, lastTouch: null });
+      return status();
+    }
+    keptTail = [];
     set({ state: 'idle', version: null, stage: null, error: null, startedAt: null, lastTouch: null });
     return status();
   }
@@ -172,4 +311,4 @@ function createSupervisor({
   return { start, stop, status, touch, reapIdle };
 }
 
-module.exports = { createSupervisor, previewable, IDLE_MS, DEFAULT_PORT, WINDOW };
+module.exports = { createSupervisor, previewable, copyInstance, IDLE_MS, DEFAULT_PORT, WINDOW };

package/modules/npm-release/public/work.css

@@ -6,3 +6,6 @@
 /* A stage's sentence sits under its head (work.js says why) and needs air before the first
    row, which drops its own top rule and padding in oversight.css. */
 #nr-work .ov-group > .ov-row__sub { margin: 8px 0 6px; }
+
+/* the preview process output shown under a failed preview (task 1004465) */
+.ov-log { max-height: 16rem; overflow: auto; margin: 0.5rem 0 0; padding: 0.5rem 0.75rem; font: 12px/1.45 ui-monospace, SFMono-Regular, Menlo, monospace; white-space: pre-wrap; word-break: break-word; background: rgba(127, 127, 127, 0.12); border-radius: 6px; }

package/modules/npm-release/public/work.js

@@ -192,7 +192,12 @@
       return `<div class="ov-note"><p><strong>Preparing a preview of ${v}</strong> — ${escapeHtml(PREVIEW_STEP[preview.stage] || 'working')}. This can take a few minutes.</p></div>`;
     }
     if (preview.state === 'failed') {
-      return `<div class="ov-note ov-note--warn"><p><strong>The preview of ${v} did not start.</strong> ${escapeHtml(preview.error || '')}</p><button type="button" class="ov-toggle" data-preview-stop>Clear</button></div>`;
+      // What the preview process itself printed (secrets already removed on the server), so a
+      // failed preview can be diagnosed here without a shell on the box (task 1004465).
+      const lines = Array.isArray(preview.log_tail) ? preview.log_tail : [];
+      const output = lines.length ? `<details open><summary>What the preview printed</summary><pre class="ov-log">${escapeHtml(lines.join('\n'))}</pre></details>` : '';
+      const headline = preview.stage === 'drop' ? `The copy of the data for ${v} could not be removed.` : `The preview of ${v} did not start.`;
+      return `<div class="ov-note ov-note--warn"><p><strong>${headline}</strong> ${escapeHtml(preview.error || '')}</p>${output}<button type="button" class="ov-toggle" data-preview-stop>${preview.stage === 'drop' ? 'Try again' : 'Clear'}</button></div>`;
     }
     return `<div class="ov-note"><p><strong>Preview of ${v} is running</strong> on a copy of this hall's data. Nothing done there reaches the live hall. It stops by itself after ${Math.round((preview.idle_ms || 0) / 60000)} minutes unused.</p>
       <a class="ov-toggle" href="${API}/npm-release/preview/enter?v=${encodeURIComponent(preview.version)}">Open the preview</a>

package/modules/npm-release/routes/preview.js

@@ -20,8 +20,8 @@
 
 const express = require('express');
 const api = require('../../../src/module-api');
-const { createDivert, clearCookie } = require('../preview/divert');
-const { createProxy, COOKIE_NAME } = require('../preview/proxy');
+const { createDivert, clearCookie, setCookie } = require('../preview/divert');
+const { createProxy } = require('../preview/proxy');
 const { previewable } = require('../preview/supervisor');
 const { VERSION_RE, PACKAGE } = require('../preview/commands');
 
@@ -55,6 +55,7 @@ module.exports = function buildNpmReleasePreviewRouter({
   const router = express.Router();
   const sup = supervisor || lazySupervisor(() => require('../preview/runtime').createRuntime({
     liveDb: process.env.PGDATABASE || api.instanceDbName(),
+    instanceRoot: api.resolveInstanceRoot(),
     log,
   }));
   const mayPreview = api.requirePermission('core.pin.move');
@@ -118,14 +119,15 @@ module.exports = function buildNpmReleasePreviewRouter({
     if (!VERSION_RE.test(v) || st.state !== 'running' || st.version !== v) {
       return failure(res, 409, 'preview_not_running', 'That preview is not running.');
     }
-    const secure = req.secure ? '; Secure' : '';
-    res.append('Set-Cookie', `${COOKIE_NAME}=${v}; Path=/; HttpOnly; SameSite=Lax${secure}`);
+    res.append('Set-Cookie', setCookie(v, req));
+    res.set('Cache-Control', 'no-store');
     sup.touch();
     return res.redirect(302, '/');
   });
 
   router.get('/npm-release/preview/exit', api.requireBuilder, mayPreview, (req, res) => {
-    res.append('Set-Cookie', clearCookie());
+    res.append('Set-Cookie', clearCookie(req));
+    res.set('Cache-Control', 'no-store');
     res.redirect(302, '/deploy');
   });
 

package/modules/provisioning/render-standup.js

@@ -31,6 +31,18 @@ const MODES = ['adopt', 'greenfield'];
 // How the owner's app is built (task 1004350): a native runtime with their commands, or
 // `docker`, which builds the repository's own Dockerfile.
 const RUNTIMES = ['node', 'python', 'ruby', 'go', 'rust', 'elixir', 'docker'];
+// Render refuses a native web service with no build command (measured live 2026-09-30,
+// task 1004464), so every native runtime has one: Render's own default for it. The runner
+// sends it when the owner gave none, and the wizard prefills it (projects.html keeps a
+// copy, pinned equal by tests/projects_hub_app_step.mjs).
+const BUILD_DEFAULTS = Object.freeze({
+  node: 'npm install',
+  python: 'pip install -r requirements.txt',
+  ruby: 'bundle install',
+  go: 'go build -tags netgo -ldflags \'-s -w\' -o app',
+  rust: 'cargo build --release',
+  elixir: 'mix deps.get --only prod && MIX_ENV=prod mix compile',
+});
 
 // Render API keys start `rnd_`; workspaces are `tea-…` (a team) or `usr-…` (a personal
 // one); services `srv-…`. Shape checks only — whether the key works, and whether it can
@@ -134,4 +146,4 @@ async function attachToProvision(db, instanceId, { keyEnc, appHost }) {
   return rows[0] || null;
 }
 
-module.exports = { attachToProvision, KEY_RE, OWNER_RE, WEB_PLANS, DB_PLANS, REGIONS, MODES, RUNTIMES, badRequest, appHostFrom, enqueueRenderStandup };
+module.exports = { attachToProvision, KEY_RE, OWNER_RE, WEB_PLANS, DB_PLANS, REGIONS, MODES, RUNTIMES, BUILD_DEFAULTS, badRequest, appHostFrom, enqueueRenderStandup };

package/modules/public-landing/public/projects.html

@@ -1433,7 +1433,7 @@ summary{min-height:24px;padding:3px 0;}
                       <option value="docker">Docker — use my repository’s Dockerfile</option>
                     </select>
                   </label>
-                  <label class="wizField" id="renderBuildWrap"><span>Build command <small>— leave empty if there is none</small></span>
+                  <label class="wizField" id="renderBuildWrap"><span>Build command <small>— Render needs one; the usual one is filled in</small></span>
                     <input type="text" id="f-renderBuild" autocomplete="off" spellcheck="false" maxlength="500" placeholder="for example: npm ci">
                   </label>
                   <label class="wizField" id="renderStartWrap"><span>Start command</span>
@@ -1808,6 +1808,18 @@ summary{min-height:24px;padding:3px 0;}
   function planPrice(p) { return p[2] ? 'about $' + p[2] + '/month' : RENDER_FREE_NOTE; }
   var RENDER_DB_PLANS = [['basic_256mb', 'Basic 256 MB', 6], ['basic_1gb', 'Basic 1 GB', 19], ['basic_4gb', 'Basic 4 GB', 75]];
   var RENDER_RUNTIMES = { node: 'Node.js', python: 'Python', ruby: 'Ruby', go: 'Go', rust: 'Rust', elixir: 'Elixir', docker: 'Docker' };
+  /* Render refuses a native app with no build command (task 1004464), so the box starts
+     with Render's own default for the runtime — a real value the owner can change, and
+     one that follows the runtime until they do. A copy of render-standup.js's
+     BUILD_DEFAULTS (this page cannot require it), pinned equal by a test. */
+  var RENDER_BUILD_DEFAULTS = {
+    node: 'npm install',
+    python: 'pip install -r requirements.txt',
+    ruby: 'bundle install',
+    go: 'go build -tags netgo -ldflags \'-s -w\' -o app',
+    rust: 'cargo build --release',
+    elixir: 'mix deps.get --only prod && MIX_ENV=prod mix compile'
+  };
   var RENDER_KEY_RE = /^rnd_[A-Za-z0-9]{16,128}$/;
   function planLabel(list, v) {
     var p = list.filter(function (x) { return x[0] === v; })[0] || list[0];
@@ -1894,6 +1906,8 @@ summary{min-height:24px;padding:3px 0;}
       q('f-renderRuntime').value = st.renderRuntime || 'node';
       var docker = q('f-renderRuntime').value === 'docker';
       q('renderBuildWrap').hidden = docker; q('renderStartWrap').hidden = docker;
+      // the runtime's usual build command until the owner types their own (task 1004464)
+      if (!st.renderBuildTouched) st.renderBuild = RENDER_BUILD_DEFAULTS[q('f-renderRuntime').value] || '';
       q('f-renderBuild').value = st.renderBuild || '';
       q('f-renderStart').value = st.renderStart || '';
       fillPlans(q('f-renderPlan'), RENDER_WEB_PLANS, st.renderPlan || 'starter');
@@ -1975,13 +1989,12 @@ summary{min-height:24px;padding:3px 0;}
       hooks.save(); syncNew();
     });
     q('renderNew').addEventListener('input', function (ev) {
-      if (ev.target.id === q('f-renderBuild').id) st.renderBuild = ev.target.value;
-      if (ev.target.id === q('f-renderStart').id) {
-        st.renderStart = ev.target.value;
-        // the "say how your app starts" ask is answered the moment there is a command —
-        // it used to stay on screen until the next press of Next
-        if (String(st.renderStart).trim() && /\berr\b/.test(q('h-render').className)) hint('h-render', '');
-      }
+      var typed = null;
+      if (ev.target.id === q('f-renderBuild').id) { st.renderBuild = ev.target.value; st.renderBuildTouched = true; typed = st.renderBuild; }
+      if (ev.target.id === q('f-renderStart').id) { st.renderStart = ev.target.value; typed = st.renderStart; }
+      // a "say how your app starts / is built" ask is answered the moment that box has a
+      // command — it used to stay on screen until the next press of Next
+      if (typed != null && String(typed).trim() && /\berr\b/.test(q('h-render').className)) hint('h-render', '');
       hooks.save();
     });
     function validate() {
@@ -1993,6 +2006,7 @@ summary{min-height:24px;padding:3px 0;}
       if (st.renderMode === 'adopt') {
         if (!services.some(function (s) { return s.id === st.renderServiceId && repoOf(s.repo) === repo().toLowerCase(); })) return bad('Choose the app to link, or create a new one.');
       } else if (st.renderMode === 'greenfield') {
+        if ((st.renderRuntime || 'node') !== 'docker' && !String(st.renderBuild || '').trim()) return bad('Say how your app is built — Render needs a build command, for example “npm install”.');
         if ((st.renderRuntime || 'node') !== 'docker' && !String(st.renderStart || '').trim()) return bad('Say how your app starts — the command Render should run, for example “npm start”.');
       } else return bad('Choose whether to create a new app or link one you already run.');
       hint('h-render', '');

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.38",
+  "version": "1.20.40",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.20.38",
+      "version": "1.20.40",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.38",
+  "version": "1.20.40",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -8333,5 +8333,21 @@
     {
       "text": "Builders on any Cloud Bongos project can now send feedback about Bongos itself with one command, and it arrives with the Bongos team as a task waiting for approval."
     }
+  ],
+  "1.20.39": [
+    {
+      "id": "1004465",
+      "text": "A version preview that cannot read its data now fails with the child's own output shown, and stopping it really removes its copy."
+    },
+    {
+      "id": "1004464",
+      "text": "Setting up an app on Render from the project wizard no longer fails when the owner leaves the build command empty. The box now comes filled in with Render's usual build command for the chosen language, which the owner can chan"
+    }
+  ],
+  "1.20.40": [
+    {
+      "id": "1004466",
+      "text": "Stop the version preview from overwriting the live hall's cookies, and make leaving a preview reliably clear it."
+    }
   ]
 }

package/scripts/gds/provision-render.js

@@ -117,6 +117,18 @@ async function greenfield(api, inst, host, deps) {
   return { ok: true };
 }
 
+// The owner reads this reason on the setup screen (app-status.js oneSentence). A refusal
+// from Render's API used to arrive as its raw line — "Render POST /services failed: …" —
+// so an answer from Render is re-said as a sentence with Render's own reason kept whole
+// (task 1004464). Anything else is already the leg's own words.
+function plainReason(e) {
+  const msg = e && e.message ? e.message : String(e);
+  const said = e && e.status != null && e.body && typeof e.body.message === 'string' ? e.body.message.trim() : '';
+  if (said) return `Render would not set up the app: ${said}`;
+  const m = /^Render (?:GET|POST|PATCH|PUT|DELETE) \S+ failed: ([\s\S]+)$/.exec(msg);
+  return m ? `Render would not set up the app: ${m[1].trim()}` : msg;
+}
+
 async function renderStandupInstance(inst, deps, intent) {
   const { db, log } = deps;
   const secretBox = deps.secretBox || require('../../src/bongos/secret-box');
@@ -137,7 +149,7 @@ async function renderStandupInstance(inst, deps, intent) {
 
     return host.mode === 'adopt' ? await adopt(api, inst, host, deps) : await greenfield(api, inst, host, deps);
   } catch (e) {
-    return refuse(e && e.message ? e.message : String(e));
+    return refuse(plainReason(e));
   } finally {
     if (intent && intent.id != null) await clearBorrowedKey(db, intent.id);
   }

package/scripts/gds/render-payload.js

@@ -21,7 +21,7 @@
 'use strict';
 
 // The vocabulary lives with the web tier's validation, so the two can never disagree.
-const { WEB_PLANS, DB_PLANS, REGIONS, RUNTIMES } = require('../../modules/provisioning/render-standup.js');
+const { WEB_PLANS, DB_PLANS, REGIONS, RUNTIMES, BUILD_DEFAULTS } = require('../../modules/provisioning/render-standup.js');
 const DEFAULTS = Object.freeze({ webPlan: 'starter', dbPlan: 'basic_256mb', region: 'virginia' });
 
 // A Render resource name from the project's slug. Render allows letters, digits and
@@ -47,14 +47,15 @@ function plansFor(appHost) {
 }
 
 // How the app is built and started, as the owner said. `docker` builds the repository's
-// own Dockerfile and needs no commands; every other runtime needs a start command, and a
-// build command if the app has a build step.
+// own Dockerfile and needs no commands; every other runtime needs a start command AND a
+// build command — Render refuses a native service without one (task 1004464), so a row
+// saved with none (including every row from before that fix) gets the runtime's default.
 function buildFor(appHost) {
   const h = appHost || {};
   if (!RUNTIMES.includes(h.runtime)) throw new Error(`unknown Render runtime '${h.runtime || 'none'}'`);
   if (h.runtime === 'docker') return { runtime: 'docker' };
   if (!h.startCommand) throw new Error('the app needs a start command');
-  return { runtime: h.runtime, buildCommand: h.buildCommand || null, startCommand: h.startCommand };
+  return { runtime: h.runtime, buildCommand: h.buildCommand || BUILD_DEFAULTS[h.runtime], startCommand: h.startCommand };
 }
 
 // POST /postgres. `plan` is never 'free' — see the header.
@@ -68,7 +69,7 @@ function renderPostgresPayload(inst, { ownerId, dbPlan, region }) {
 function renderServicePayload(inst, { ownerId, repoUrl, branch, webPlan, region, build, dbUrl }) {
   const envSpecificDetails = build.runtime === 'docker'
     ? {}
-    : { ...(build.buildCommand ? { buildCommand: build.buildCommand } : {}), startCommand: build.startCommand };
+    : { buildCommand: build.buildCommand, startCommand: build.startCommand };
   return {
     type: 'web_service',
     name: resourceName(inst),

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.20.38'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.20.40'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/npm_release_preview_commands.mjs

@@ -52,7 +52,7 @@ test('the copy is a custom-format dump of the live database, restored with no ow
 
 test('the copy is created empty and dropped if it is already there', () => {
   assert.deepEqual(c.createDbCommand(), { cmd: 'createdb', args: [PREVIEW_DB] });
-  assert.deepEqual(c.dropDbCommand(), { cmd: 'dropdb', args: ['--if-exists', PREVIEW_DB] });
+  assert.deepEqual(c.dropDbCommand(), { cmd: 'dropdb', args: ['--if-exists', '--force', PREVIEW_DB] });
 });
 
 test('the install is one version of the core into its own directory, production dependencies only', () => {