@bongos/core 1.20.38 → 1.20.40

package/tests/npm_release_preview_diagnosis.mjs

@@ -0,0 +1,376 @@
+// tests/npm_release_preview_diagnosis.mjs — a preview that cannot serve data must say so (task 1004465).
+//
+// WHAT WENT WRONG LIVE. The first real preview started, answered /healthz, was reported
+// running, and then returned 500 on every page; the child's output went nowhere (stdio
+// 'ignore'), so nobody could say why. Stopping it left the copy database behind, because the
+// child was killed without waiting and the failed dropdb was ignored. These tests pin the four
+// repairs: the child's output is kept and redacted, the health check proves data can be read,
+// a stop waits for the child before dropping, and a drop that fails is reported, never idle.
+// Every spawn, command, probe, clock and file is injected.
+//
+// Run:  node --test tests/npm_release_preview_diagnosis.mjs
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { EventEmitter } from 'node:events';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const { createSupervisor, copyInstance } = require('../modules/npm-release/preview/supervisor.js');
+const cmds = require('../modules/npm-release/preview/commands.js');
+const { createChildLog, redact, secretValues } = require('../modules/npm-release/preview/childlog.js');
+const { probeHealth } = require('../modules/npm-release/preview/runtime.js');
+const { PREVIEW_DB, buildPreviewEnv } = require('../modules/npm-release/preview/env.js');
+
+const fwd = (x) => String(x).split(String.fromCharCode(92)).join('/');
+// Secret-shaped strings assembled at run time, so no scanner mistakes this file for a leak.
+const FAKE_GH = ['gh', 'p_', 'abcdefghijklmnopqrstuvwxyz0123'].join('');
+const FAKE_URL = ['post', 'gres://svc:pw9999@db/x'].join('');
+
+// `sleepMode`: 'instant' returns at once (the health loop's waits); 'never' returns only for
+// waits under a second, so a stop can be released ONLY by the child's real exit.
+function rig({ probe = async () => true, failRun = () => false, killBehaviour = 'exit', sleepMode = 'instant', instanceRoot = null, env, liveDb = 'live_db', copy } = {}) {
+  const events = [];
+  const calls = [];
+  const fake = { spawned: [], rm: [] };
+  const sup = createSupervisor({
+    run: async (cmd) => {
+      calls.push(cmd);
+      events.push(cmd.cmd);
+      return failRun(cmd) ? { code: 3, stderr: 'boom from ' + cmd.cmd } : { code: 0, stderr: '' };
+    },
+    spawn: (bin, args, opts) => {
+      const child = new EventEmitter();
+      child.stdout = new EventEmitter();
+      child.stderr = new EventEmitter();
+      child.bin = bin; child.args = args; child.opts = opts;
+      child.kill = (sig) => {
+        events.push('kill:' + sig);
+        if (killBehaviour === 'exit') setImmediate(() => { events.push('exit'); child.emit('exit', 0); });
+        if (killBehaviour === 'on-sigkill' && sig === 'SIGKILL') setImmediate(() => { events.push('exit'); child.emit('exit', null); });
+      };
+      fake.spawned.push(child);
+      return child;
+    },
+    probe,
+    sleep: (ms) => (sleepMode === 'instant' || ms < 1000 ? Promise.resolve() : sleepMode === 'short' ? new Promise((r) => setTimeout(r, 10)) : new Promise(() => {})),
+    now: () => 1_000_000,
+    fsImpl: { mkdtempSync: (p) => p + 'XYZ', mkdirSync() {}, rmSync: (p) => fake.rm.push(p), writeFile() {}, existsSync: () => false, readFileSync: () => { throw new Error('none'); } },
+    tmpdir: '/tmp', liveDb, cacheRoot: '/cache', port: 3190, instanceRoot, copy,
+    env: env || { PATH: '/bin' },
+  });
+  return { sup, events, calls, fake };
+}
+
+// ---- the child's output: kept, capped, redacted ---------------------------------------
+
+test('what the child printed is kept and shown when the preview cannot serve data', async () => {
+  const r = rig({
+    env: { PATH: '/bin', PGPASSWORD: 'hunter2pass', GITHUB_TOKEN: FAKE_GH },
+    probe: async () => {
+      r.fake.spawned[0].stderr.emit('data', 'error: relation "builders" does not exist\n');
+      r.fake.spawned[0].stdout.emit('data', `connecting with password=abc123 to ${FAKE_URL} using hunter2pass and ${FAKE_GH}\n`);
+      return { ok: false, reason: 'a database-backed read (/api/bongos/me) answered 500' };
+    },
+  });
+  await r.sup.start('1.19.1000').done;
+  const s = r.sup.status();
+  assert.equal(s.state, 'failed');
+  const tail = s.log_tail.join('\n');
+  assert.match(tail, /relation "builders" does not exist/);
+  assert.match(s.error, /Its last output:.*relation "builders" does not exist/);
+  for (const secret of ['hunter2pass', 'abc123', 'pw9999', FAKE_GH]) {
+    assert.ok(!tail.includes(secret), 'the tail leaks a secret');
+    assert.ok(!s.error.includes(secret), 'the error leaks a secret');
+  }
+});
+
+test('the tail is at most twenty lines and each line is short', () => {
+  const lg = createChildLog({});
+  lg.append(Array.from({ length: 50 }, (_, i) => 'line ' + i).join('\n') + '\n' + 'x'.repeat(1000) + '\n');
+  const t = lg.tail();
+  assert.equal(t.length, 20);
+  assert.ok(t.every((l) => l.length <= 301));
+});
+
+test('the log is capped, keeping the newest output', () => {
+  const lg = createChildLog({ cap: 100 });
+  lg.append('a'.repeat(500));
+  lg.append('THE-END');
+  assert.ok(lg.size() <= 100);
+  assert.match(lg.tail().join('\n'), /THE-END$/);
+});
+
+test('redaction takes out listed values and the common secret shapes', () => {
+  const secrets = secretValues({ SESSION_SECRET: 'sekrit-value-1', NOT_ONE: 'visible-value', PGPASSWORD: 'p' });
+  assert.deepEqual(secrets, ['sekrit-value-1'], 'only secret-named, long-enough values');
+  const out = redact(`x sekrit-value-1 y Bearer abc.def-ghi ${FAKE_URL} token=zzz visible-value`, secrets);
+  assert.ok(!/sekrit-value-1|abc\.def|pw9999|zzz/.test(out), out);
+  assert.match(out, /visible-value/);
+});
+
+test('the log is also written to a file in the scratch directory, and a failing disk does not matter', () => {
+  const writes = [];
+  const lg = createChildLog({ fsImpl: { writeFile: (f, b, cb) => { writes.push([f, b]); cb(); } }, file: '/tmp/x/preview.log', flushMs: 1e6 });
+  lg.append('hello');
+  lg.flush();
+  assert.deepEqual(writes, [['/tmp/x/preview.log', 'hello']]);
+  lg.close();
+  const broken = createChildLog({ fsImpl: { writeFile() { throw new Error('disk'); } }, file: '/f', flushMs: 1e6 });
+  broken.append('still fine');
+  assert.doesNotThrow(() => broken.flush());
+  broken.close();
+});
+
+test('a burst of output costs one asynchronous write, never one write per chunk, and none after close', async () => {
+  const writes = [];
+  const lg = createChildLog({ fsImpl: { writeFile: (f, b, cb) => { writes.push(b); cb(); } }, file: '/f', flushMs: 5 });
+  for (let i = 0; i < 500; i++) lg.append('line ' + i + '\n');
+  assert.equal(writes.length, 0, 'nothing is written inside the data handler');
+  await new Promise((r) => setTimeout(r, 40));
+  assert.equal(writes.length, 1, 'the burst was written once');
+  assert.match(writes[0], /line 499/);
+  lg.append('after');
+  lg.close();
+  await new Promise((r) => setTimeout(r, 40));
+  assert.equal(writes.length, 1, 'closing cancels a pending write');
+});
+
+// ---- ready means it can serve data ----------------------------------------------------
+
+test('a probe that sees a database failure fails the preview, says why, and cleans up', async () => {
+  const { sup, events, fake, calls } = rig({ probe: async () => ({ ok: false, reason: '/version reports schemaPending null: the database copy could not be read' }) });
+  await sup.start('1.19.1000').done;
+  const s = sup.status();
+  assert.equal(s.state, 'failed');
+  assert.match(s.error, /could not serve data/);
+  assert.match(s.error, /schemaPending null/);
+  assert.ok(events.includes('kill:SIGTERM'), 'the child was stopped');
+  assert.deepEqual(calls[calls.length - 1], cmds.dropDbCommand(), 'the copy was dropped');
+  assert.equal(fake.rm.length, 1, 'the scratch directory was removed');
+});
+
+test('a preview is running only once the probe says it can serve data', async () => {
+  const answers = [{ ok: false, reason: 'warming up' }, { ok: false, reason: 'warming up' }, { ok: true }];
+  const { sup } = rig({ probe: async () => answers.shift() });
+  await sup.start('1.19.1000').done;
+  assert.equal(sup.status().state, 'running');
+});
+
+test('a bare true from the probe still counts as healthy (older callers)', async () => {
+  const { sup } = rig({ probe: async () => true });
+  await sup.start('1.19.1000').done;
+  assert.equal(sup.status().state, 'running');
+});
+
+test('a child that exits while starting fails the start at once, with its output', async () => {
+  let probes = 0;
+  const r = rig({
+    probe: async () => {
+      probes += 1;
+      r.fake.spawned[0].stderr.emit('data', 'Error: Cannot find module "./nope"\n');
+      r.fake.spawned[0].emit('exit', 1);
+      return false;
+    },
+  });
+  await r.sup.start('1.19.1000').done;
+  assert.equal(probes, 1, 'it did not keep probing a dead child');
+  assert.match(r.sup.status().error, /exited \(1\) before it could serve data/);
+  assert.match(r.sup.status().error, /Cannot find module/);
+  assert.equal(r.sup.status().state, 'failed');
+});
+
+// ---- the probe itself ------------------------------------------------------------------
+
+function fakeGet(map) {
+  return async (port, p) => map[p] || { error: 'refused' };
+}
+const HEALTHZ = { status: 200, body: '{}' };
+const OK = { status: 200, body: '{"coreVersion":"1.19.1000","schemaPending":0}' };
+
+test('the probe passes only when healthz, /version and a database-backed read all answer', async () => {
+  const r = await probeHealth(3190, fakeGet({ '/healthz': HEALTHZ, '/version': OK, '/api/bongos/me': { status: 401, body: '{}' } }));
+  assert.deepEqual(r, { ok: true });
+});
+
+test('schemaPending null (the database read failed) fails the probe even though /healthz is 200', async () => {
+  const r = await probeHealth(3190, fakeGet({ '/healthz': HEALTHZ, '/version': { status: 200, body: '{"schemaPending":null,"commit":null}' }, '/api/bongos/me': { status: 401, body: '' } }));
+  assert.equal(r.ok, false);
+  assert.match(r.reason, /schemaPending null/);
+});
+
+test('a 500 from a database-backed route fails the probe', async () => {
+  const r = await probeHealth(3190, fakeGet({ '/healthz': HEALTHZ, '/version': OK, '/api/bongos/me': { status: 500, body: '' } }));
+  assert.equal(r.ok, false);
+  assert.match(r.reason, /\/api\/bongos\/me\) answered 500/);
+});
+
+test('a version too old to report schemaPending is judged by the database-backed read alone', async () => {
+  const old = { status: 200, body: '{"coreVersion":"1.0.1"}' };
+  const good = await probeHealth(3190, fakeGet({ '/healthz': HEALTHZ, '/version': old, '/api/bongos/me': { status: 401, body: '' } }));
+  assert.equal(good.ok, true);
+  const bad = await probeHealth(3190, fakeGet({ '/healthz': HEALTHZ, '/version': old, '/api/bongos/me': { status: 500, body: '' } }));
+  assert.equal(bad.ok, false);
+});
+
+test('nothing answering, or /healthz not 200, fails the probe', async () => {
+  assert.equal((await probeHealth(3190, fakeGet({}))).ok, false);
+  assert.equal((await probeHealth(3190, fakeGet({ '/healthz': { status: 503, body: '' } }))).ok, false);
+});
+
+// ---- the child's working directory is an instance --------------------------------------
+
+test('the child runs in a scratch instance holding the live config, and is told so', async () => {
+  const copied = [];
+  const { sup, fake, calls } = rig({ instanceRoot: '/live/root', copy: (o) => copied.push([o.from, fwd(o.to)]) });
+  await sup.start('1.19.1000').done;
+  assert.deepEqual(copied, [['/live/root', '/tmp/bongos-preview-XYZ/instance']]);
+  const child = fake.spawned[0];
+  assert.equal(fwd(child.opts.cwd), '/tmp/bongos-preview-XYZ/instance');
+  assert.equal(fwd(child.opts.env.BONGOS_INSTANCE_ROOT), '/tmp/bongos-preview-XYZ/instance');
+  const migrate = calls.find((c) => c.cmd === 'bash');
+  assert.equal(fwd(migrate.cwd), '/tmp/bongos-preview-XYZ/instance');
+  assert.equal(fwd(migrate.env.INIT_CWD), '/tmp/bongos-preview-XYZ/instance');
+  assert.equal(migrate.env.PGDATABASE, PREVIEW_DB);
+});
+
+test('without an instance root the child still runs from its install directory', async () => {
+  const { sup, fake } = rig();
+  await sup.start('1.19.1000').done;
+  assert.equal(fwd(fake.spawned[0].opts.cwd), '/cache/1.19.1000');
+  assert.equal(fake.spawned[0].opts.env.BONGOS_INSTANCE_ROOT, undefined);
+});
+
+test('copying the instance takes the boot packs and instance migrations, and nothing else from config', () => {
+  const from = fs.mkdtempSync(path.join(os.tmpdir(), 'pv-from-'));
+  const to = fs.mkdtempSync(path.join(os.tmpdir(), 'pv-to-'));
+  try {
+    fs.mkdirSync(path.join(from, 'config'));
+    fs.mkdirSync(path.join(from, 'migrations', 'instance'), { recursive: true });
+    fs.writeFileSync(path.join(from, 'config', 'branding.json'), '{"envPrefix":"ACME"}');
+    fs.writeFileSync(path.join(from, 'config', 'modules.json'), '{}');
+    // files that are not on the allow-list stay behind whatever they are called
+    for (const name of ['go-live.json', 'push-token.json', 'apikey.json', 'db-creds.json', 'notes.txt']) fs.writeFileSync(path.join(from, 'config', name), '{}');
+    fs.writeFileSync(path.join(from, 'migrations', 'instance', '0001_x.sql'), 'select 1;');
+    copyInstance({ fsImpl: fs, from, to });
+    assert.deepEqual(fs.readdirSync(path.join(to, 'config')).sort(), ['branding.json', 'modules.json']);
+    assert.deepEqual(fs.readdirSync(path.join(to, 'migrations', 'instance')), ['0001_x.sql']);
+    // an instance with neither directory is not an error
+    copyInstance({ fsImpl: fs, from: path.join(from, 'nowhere'), to });
+  } finally {
+    fs.rmSync(from, { recursive: true, force: true });
+    fs.rmSync(to, { recursive: true, force: true });
+  }
+});
+
+test('the module switches cover every env prefix the core resolves (a tripwire against drift)', () => {
+  const ic = require('../src/instance-config');
+  const { MODULES_OFF } = require('../modules/npm-release/preview/env.js');
+  for (const pfx of [ic.FALLBACK_ENV_PREFIX, ...ic.LEGACY_ENV_PREFIXES]) {
+    assert.ok(MODULES_OFF.includes(pfx + '_MODULE_DISCORD'), 'no switch under the ' + pfx + ' prefix: a prefix the core reads would leave the module on');
+  }
+});
+
+test('the module switches are set under every prefix, including the copied instance own', () => {
+  const env = buildPreviewEnv({ port: 3190, scratchHome: '/h', instanceRoot: '/i', envPrefix: 'ACME' });
+  for (const pfx of ['BONGOS', 'CLOUDBONGOS', 'OTB', 'GDS', 'PMS', 'ACME']) {
+    assert.equal(env[pfx + '_MODULE_DISCORD'], '0', pfx);
+    assert.equal(env[pfx + '_MODULE_AGENTS'], '0', pfx);
+  }
+  assert.equal(buildPreviewEnv({ port: 1, scratchHome: '/h', envPrefix: 'bad prefix; rm' }).ACME_MODULE_DISCORD, undefined);
+});
+
+// ---- stopping really drops the copy ------------------------------------------------------
+
+test('stop waits for the child to exit before it drops the copy', async () => {
+  // sleepMode "never": nothing but the child's own exit can let the stop go on.
+  const { sup, events } = rig({ sleepMode: 'never' });
+  await sup.start('1.19.1000').done;
+  events.length = 0;
+  await sup.stop();
+  assert.deepEqual(events, ['kill:SIGTERM', 'exit', 'dropdb']);
+  assert.equal(sup.status().state, 'idle');
+});
+
+test('a child that ignores SIGTERM is killed with SIGKILL before the drop', async () => {
+  const { sup, events } = rig({ killBehaviour: 'on-sigkill', sleepMode: 'short' });
+  await sup.start('1.19.1000').done;
+  events.length = 0;
+  await sup.stop();
+  assert.deepEqual(events, ['kill:SIGTERM', 'kill:SIGKILL', 'exit', 'dropdb']);
+});
+
+test('a failed dropdb is retried after ending the copy backends, then reported instead of idle', async () => {
+  let failing = false;
+  const { sup, calls } = rig({ failRun: (c) => failing && c.cmd === 'dropdb' });
+  await sup.start('1.19.1000').done;
+  failing = true;
+  calls.length = 0;
+  const s = await sup.stop();
+  assert.deepEqual(calls.map((c) => c.cmd), ['dropdb', 'psql', 'dropdb']);
+  assert.equal(calls[0].args.includes('--force'), true);
+  assert.equal(calls[2].args.includes('--force'), false, 'the retry is plain');
+  assert.equal(s.state, 'failed');
+  assert.equal(s.stage, 'drop');
+  assert.match(s.error, /could not be dropped/);
+  assert.equal(sup.status().state, 'failed', 'and it stays reported until a drop works');
+});
+
+test('a dropdb that fails only for want of --force is rescued by the fallback', async () => {
+  let forceFails = false;
+  const { sup } = rig({ failRun: (c) => forceFails && c.cmd === 'dropdb' && c.args.includes('--force') });
+  await sup.start('1.19.1000').done;
+  forceFails = true;
+  const s = await sup.stop();
+  assert.equal(s.state, 'idle');
+});
+
+test('a failed start whose copy will not drop says both things', async () => {
+  let dropsFail = false;
+  const { sup } = rig({
+    probe: async () => { dropsFail = true; return { ok: false, reason: 'the data path is broken' }; },
+    failRun: (c) => dropsFail && c.cmd === 'dropdb',
+  });
+  await sup.start('1.19.1000').done;
+  const s = sup.status();
+  assert.equal(s.state, 'failed');
+  assert.match(s.error, /the data path is broken/);
+  assert.match(s.error, /could not be dropped/);
+});
+
+// ---- the drop can never name the live database ---------------------------------------------
+
+test('a supervisor whose live database is the preview name cannot be built', () => {
+  assert.throws(() => rig({ liveDb: PREVIEW_DB }), /cannot be named bongos_preview/);
+});
+
+test('every drop command names the fixed copy, and nothing else passes the guard', () => {
+  for (const c of [cmds.dropDbCommand(), cmds.dropDbPlainCommand(), cmds.terminateBackendsCommand()]) {
+    assert.equal(cmds.targetsOnlyPreviewDb(c), true, JSON.stringify(c));
+    assert.ok(JSON.stringify(c).includes(PREVIEW_DB));
+  }
+  for (const bad of [
+    { cmd: 'dropdb', args: ['--if-exists', 'live_db'] },
+    { cmd: 'dropdb', args: ['live_db', PREVIEW_DB] },
+    { cmd: 'dropdb', args: ['--if-exists', '--force', 'live_db'] },
+    { cmd: 'psql', args: ['-d', 'postgres', '-c', 'DROP DATABASE live_db'] },
+    { cmd: 'psql', args: ['-X', '-d', 'postgres', '-tAc', "SELECT pg_terminate_backend(pid) FROM pg_stat_activity WHERE datname = 'live_db'"] },
+    { cmd: 'bash', args: ['-c', 'dropdb ' + PREVIEW_DB] },
+    null,
+  ]) assert.equal(cmds.targetsOnlyPreviewDb(bad), false, JSON.stringify(bad));
+  assert.match(cmds.terminateBackendsCommand().args.join(' '), /datname = 'bongos_preview' AND pid <> pg_backend_pid\(\)/);
+});
+
+test('every drop-capable command a start and stop runs is the guarded kind, none naming the live database', async () => {
+  const { sup, calls } = rig({ failRun: (c) => c.cmd === 'dropdb' });
+  await sup.start('1.19.1000').done;
+  await sup.stop();
+  const risky = calls.filter((x) => x.cmd === 'dropdb' || x.cmd === 'psql');
+  assert.ok(risky.length > 0);
+  for (const c of risky) {
+    assert.equal(cmds.targetsOnlyPreviewDb(c), true, JSON.stringify(c));
+    assert.ok(!JSON.stringify(c.args).includes('live_db'));
+  }
+});

package/tests/npm_release_preview_divert.mjs

@@ -159,6 +159,16 @@ test('a cookie for a preview that is not running is dropped and the live hall an
   }
 });
 
+test('the clearing cookie repeats the set attributes, Secure included (task 1004466)', () => {
+  const { setCookie } = require('../modules/npm-release/preview/divert.js');
+  for (const secure of [false, true]) {
+    const req = { secure };
+    const attrs = (c) => c.split('; ').slice(1).filter((a) => !/^Max-Age=/.test(a)).join('; ');
+    assert.equal(attrs(clearCookie(req)), attrs(setCookie('1.19.1000', req)), 'secure=' + secure);
+    assert.equal(/; Secure$/.test(clearCookie(req)), secure);
+  }
+});
+
 test('the clearing cookie expires the steering cookie for the whole site', () => {
   assert.match(clearCookie(), /^bongos_preview=; Path=\/; Max-Age=0/);
 });

package/tests/npm_release_preview_proxy.mjs

@@ -137,6 +137,32 @@ test('JSON and other non-page answers pass through untouched, headers included',
   assert.doesNotMatch(res.text, /banner/);
 });
 
+test('a Set-Cookie from the preview never reaches the browser (it would overwrite the live hall cookies), task 1004466', async () => {
+  const cookies = ['cb_stealth=child; Path=/', '__Host-sid=child; Path=/; Secure', 'bongos_preview=; Max-Age=0'];
+  for (const [type, body] of [['application/json', '{}'], ['text/html; charset=utf-8', '<html><body>x</body></html>']]) {
+    const http = fakeHttp(() => ({ headers: { 'content-type': type, 'set-cookie': cookies, 'x-keep': 'yes' }, body }));
+    const res = new FakeRes();
+    make(http)(request(), res);
+    await finish(res);
+    assert.equal(Object.keys(res.headers).filter((k) => k.toLowerCase() === 'set-cookie').length, 0, type);
+    assert.equal(res.headers['x-keep'], 'yes', 'other headers still pass');
+  }
+});
+
+test('a streamed answer with a Set-Cookie is still streamed, cookie dropped', async () => {
+  const stream = new PassThrough();
+  const http = fakeHttp(() => ({ headers: { 'content-type': 'text/event-stream', 'set-cookie': 'cb_stealth=child' }, stream }));
+  const res = new FakeRes();
+  make(http)(request(), res);
+  await tick();
+  stream.write('data: one\n\n');
+  await tick();
+  assert.equal(res.headers['set-cookie'], undefined);
+  assert.equal(res.text, 'data: one\n\n');
+  stream.end();
+  await finish(res);
+});
+
 test('an event stream is streamed, not held: the first chunk arrives before the stream ends', async () => {
   const stream = new PassThrough();
   const http = fakeHttp(() => ({ headers: { 'content-type': 'text/event-stream' }, stream }));

package/tests/npm_release_preview_routes.mjs

@@ -52,6 +52,7 @@ let base;
 before(async () => {
   state = { state: 'idle', version: null };
   const app = express();
+  app.set('trust proxy', true);
   app.use(express.json());
   app.use('/api/bongos', buildRouter({ supervisor, listPublished: async () => registry, runningVersion: () => '1.19.1040' }));
   server = http.createServer(app);
@@ -60,10 +61,10 @@ before(async () => {
 });
 after(() => new Promise((r) => server.close(r)));
 
-function call(method, url, { cookie = 'sid=good', body } = {}) {
+function call(method, url, { cookie = 'sid=good', body, extra } = {}) {
   return new Promise((resolve, reject) => {
     const data = body === undefined ? null : JSON.stringify(body);
-    const headers = { host: 'builders.example.test' };
+    const headers = { host: 'builders.example.test', ...(extra || {}) };
     if (cookie) headers.cookie = cookie;
     if (data) { headers['content-type'] = 'application/json'; headers['content-length'] = Buffer.byteLength(data); }
     const r = http.request({ host: '127.0.0.1', port: base, path: '/api/bongos' + url, method, headers }, (res) => {
@@ -178,6 +179,18 @@ test('enter sets the steering cookie for the running version and goes to the hal
   assert.match(c, /^bongos_preview=1\.19\.1030; Path=\/; HttpOnly; SameSite=Lax/);
 });
 
+test('exit clears with the same attributes enter set, Secure included, and is not cached (task 1004466)', async () => {
+  state = { state: 'running', version: '1.19.1030' };
+  for (const extra of [undefined, { 'x-forwarded-proto': 'https' }]) {
+    const e = await call('GET', '/npm-release/preview/enter?v=1.19.1030', { extra });
+    const x = await call('GET', '/npm-release/preview/exit', { extra });
+    const attrs = (r) => [].concat(r.headers['set-cookie'])[0].split('; ').slice(1).filter((a) => !/^Max-Age=/.test(a)).join('; ');
+    assert.equal(attrs(x), attrs(e));
+    assert.equal(/Secure/.test(attrs(x)), Boolean(extra));
+    assert.equal(x.headers['cache-control'], 'no-store');
+  }
+});
+
 test('enter refuses a preview that is not the one running, and sets no cookie', async () => {
   for (const [st, v] of [[{ state: 'idle', version: null }, '1.19.1030'], [{ state: 'starting', version: '1.19.1030' }, '1.19.1030'], [{ state: 'running', version: '1.19.1031' }, '1.19.1030'], [{ state: 'running', version: '1.19.1030' }, 'zzz']]) {
     state = st;

package/tests/npm_release_preview_supervisor.mjs

@@ -28,7 +28,7 @@ function rig({ failOn, probeResults, env } = {}) {
     },
     spawn: (bin, args, opts) => {
       const handlers = {};
-      const child = { bin, args, opts, on: (ev, fn) => { handlers[ev] = fn; }, kill: () => { fake.killed += 1; }, emit: (ev, ...a) => handlers[ev] && handlers[ev](...a) };
+      const child = { bin, args, opts, on: (ev, fn) => { handlers[ev] = fn; }, kill: (sig) => { fake.killed += 1; (fake.signals ||= []).push(sig); if (handlers.exit) handlers.exit(0); }, emit: (ev, ...a) => handlers[ev] && handlers[ev](...a) };
       fake.spawned.push(child);
       return child;
     },
@@ -46,7 +46,7 @@ function rig({ failOn, probeResults, env } = {}) {
 }
 
 const fwd = (x) => String(x).split(String.fromCharCode(92)).join('/');
-const DROP = { cmd: 'dropdb', args: ['--if-exists', PREVIEW_DB] };
+const DROP = { cmd: 'dropdb', args: ['--if-exists', '--force', PREVIEW_DB] };
 
 test('a start runs install, copy, restore and migrate, in that order, then launches and waits for health', async () => {
   const { sup, calls, fake } = rig();
@@ -89,9 +89,9 @@ for (const failOn of ['npm', 'dropdb', 'createdb', 'dump', 'pg_restore', 'bash']
     await sup.start('1.19.1000').done;
     const s = sup.status();
     assert.equal(s.state, 'failed');
-    assert.match(s.error, /failed \(exit 3\)/);
+    assert.match(s.error, failOn === 'dropdb' ? /could not be dropped/ : /failed [(]exit 3[)]/);
     assert.equal(fake.spawned.length, 0, 'no process was started');
-    assert.deepEqual(calls[calls.length - 1], DROP, 'the copy is dropped last');
+    if (failOn !== 'dropdb') assert.deepEqual(calls[calls.length - 1], DROP, 'the copy is dropped last');
     assert.equal(rmCalls.length, 1, 'the scratch directory is removed');
   });
 }

package/tests/projects_hub_app_step.mjs

@@ -23,6 +23,8 @@ import fs from 'node:fs';
 import path from 'node:path';
 import vm from 'node:vm';
 import { fileURLToPath } from 'node:url';
+import { createRequire } from 'node:module';
+const require = createRequire(import.meta.url);
 
 const ROOT = path.join(path.dirname(fileURLToPath(import.meta.url)), '..');
 const HUB = fs.readFileSync(path.join(ROOT, 'modules', 'public-landing', 'public', 'projects.html'), 'utf8').replace(/\r\n/g, '\n');
@@ -301,6 +303,53 @@ test('typing a start command clears the "how your app starts" ask at once', asyn
   assert.doesNotMatch(w.$('h-render').textContent, /how your app starts/);
 });
 
+// task 1004464 — Render refused a native app with no build command, live, on project 43.
+test('the build command starts as the runtime\'s usual one, follows the runtime, and yields to the owner\'s own', async () => {
+  const w = load({ answers: ANSWERS, draft: { appPlatform: 'render' } });
+  w.typeKey(KEY);
+  await w.check();
+  await w.pickWorkspace(0);
+  w.pickService({ value: 'new' });
+  assert.equal(w.$('f-renderBuild').value, 'npm install', 'Node.js starts with npm install');
+  w.$('f-renderRuntime').value = 'python';
+  w.$('renderNew').fire('change', { target: w.$('f-renderRuntime') });
+  assert.equal(w.$('f-renderBuild').value, 'pip install -r requirements.txt', 'it follows the runtime');
+  w.$('f-renderBuild').value = 'make build';
+  w.$('renderNew').fire('input', { target: w.$('f-renderBuild') });
+  w.$('f-renderRuntime').value = 'ruby';
+  w.$('renderNew').fire('change', { target: w.$('f-renderRuntime') });
+  assert.equal(w.$('f-renderBuild').value, 'make build', 'the owner\'s own command is never overwritten');
+  w.state.renderStart = 'bundle exec puma';
+  assert.equal(w.renderRequestBody().build_command, 'make build');
+});
+
+test('an emptied build command is refused before Render ever sees it, and the ask clears on typing', async () => {
+  const w = load({ answers: ANSWERS, draft: { appPlatform: 'render' } });
+  w.typeKey(KEY);
+  await w.check();
+  await w.pickWorkspace(0);
+  w.pickService({ value: 'new' });
+  w.state.renderStart = 'npm start';
+  w.$('f-renderBuild').value = '';
+  w.$('renderNew').fire('input', { target: w.$('f-renderBuild') });
+  assert.equal(w.validateRender(), false);
+  assert.match(w.$('h-render').textContent, /how your app is built/);
+  w.$('f-renderBuild').value = 'npm ci';
+  w.$('renderNew').fire('input', { target: w.$('f-renderBuild') });
+  assert.doesNotMatch(w.$('h-render').className, /err/);
+  assert.equal(w.validateRender(), true);
+});
+
+test('the page\'s build defaults are the runner\'s, key for key', () => {
+  const { BUILD_DEFAULTS, RUNTIMES } = require('../modules/provisioning/render-standup.js');
+  const src = HUB.replace(/\r\n/g, '\n').match(/var RENDER_BUILD_DEFAULTS = (\{[\s\S]*?\});/);
+  assert.ok(src, 'the page carries RENDER_BUILD_DEFAULTS');
+  const page = vm.runInNewContext('(' + src[1] + ')');
+  assert.deepEqual({ ...page }, { ...BUILD_DEFAULTS });
+  assert.deepEqual(Object.keys(page).sort(), RUNTIMES.filter((r) => r !== 'docker').sort());
+  assert.doesNotMatch(HUB, /leave empty if there is none/);
+});
+
 test('the empty command boxes read as examples, not as filled-in values', () => {
   assert.match(HUB, /id="f-renderBuild"[^>]*placeholder="for example: npm ci"/);
   assert.match(HUB, /id="f-renderStart"[^>]*placeholder="for example: npm start"/);

package/tests/projects_hub_render_connect.mjs

@@ -250,7 +250,8 @@ test('Connect sends the key once, to this project, forgets it, and the card show
   const sent = w.calls.filter((c) => c.url === RENDER);
   assert.equal(sent.length, 1);
   assert.equal(sent[0].method, 'POST');
-  assert.deepEqual(sent[0].body, { key: KEY, owner_id: TEA_A, mode: 'greenfield', runtime: 'node', start_command: 'npm start', web_plan: 'starter', database: false });
+  // build_command: the runtime's usual one, prefilled — Render refuses a native app without one (task 1004464)
+  assert.deepEqual(sent[0].body, { key: KEY, owner_id: TEA_A, mode: 'greenfield', runtime: 'node', start_command: 'npm start', build_command: 'npm install', web_plan: 'starter', database: false });
   for (const c of w.calls) assert.ok(!c.url.includes(KEY), 'no URL carries the key');
   assert.equal(w.q('f-renderKey').value, '', 'the field is emptied');
   assert.equal(w.byId('mAppConnectForm').hidden, true, 'the form closes');

package/tests/provision_render.mjs

@@ -335,11 +335,32 @@ await ta('a link needs a repository to check the service against (1004350 review
   assert.equal(out.ok, false);
   assert.equal(h.cleared(), 1);
 });
-await ta('an app with no build step sends no build command at all (1004350 review)', async () => {
+// The 1004350 review asked for NO build command here; Render refused exactly that live
+// ("buildCommand is required for non-static, non-docker services", task 1004464), so a
+// row saved without one — every row from before the fix included — gets the runtime's
+// default, and a Retry of such a row now works.
+await ta('an app saved with no build command gets its runtime\'s default, as Render requires (task 1004464)', async () => {
   const h = harness({ host: { buildCommand: undefined } });
   await h.run();
   const svc = h.r.calls.find((c) => c.method === 'POST' && c.path === '/services').body;
-  assert.deepEqual(svc.serviceDetails.envSpecificDetails, { startCommand: 'npm start' });
+  assert.deepEqual(svc.serviceDetails.envSpecificDetails, { buildCommand: 'npm install', startCommand: 'npm start' });
+});
+await ta('every native runtime has a default build command; docker still sends none (task 1004464)', () => {
+  const { RUNTIMES, BUILD_DEFAULTS } = require('../modules/provisioning/render-standup.js');
+  const { buildFor } = require('../scripts/gds/render-payload.js');
+  for (const rt of RUNTIMES.filter((r) => r !== 'docker')) {
+    assert.ok(BUILD_DEFAULTS[rt], `${rt} has a default`);
+    assert.equal(buildFor({ runtime: rt, startCommand: 'x' }).buildCommand, BUILD_DEFAULTS[rt]);
+    assert.equal(buildFor({ runtime: rt, startCommand: 'x', buildCommand: 'make' }).buildCommand, 'make', 'the owner\'s own wins');
+  }
+  assert.deepEqual(buildFor({ runtime: 'docker' }), { runtime: 'docker' });
+});
+await ta('a refusal from Render reads as a sentence, with Render\'s own reason kept (task 1004464)', async () => {
+  const h = harness({ host: { database: false }, render: { 'POST /services': new Error('buildCommand is required for non-static, non-docker services.') } });
+  const out = await h.run();
+  assert.equal(out.ok, false);
+  assert.equal(h.lastHost().error, 'Render would not set up the app: buildCommand is required for non-static, non-docker services.');
+  assert.doesNotMatch(h.lastHost().error, /POST \/services/, 'no raw HTTP line reaches the owner');
 });
 
 console.log('\nteardown forgets, never deletes:');