@bongos/core 1.21.95 → 1.21.97

package/tests/github_pick_up.mjs

@@ -0,0 +1,366 @@
+// tests/github_pick_up.mjs — "GitHub retry picks up where it stopped, never makes a second
+// app, and every failure has a button that fixes it" (task 1004652).
+//
+// WHY. Retrying the GitHub step used to mint a new link, which makes a SECOND app on the
+// founder's account; "Start again" appeared only after 90 seconds; and two failures ended
+// at "contact us" or "delete the orphan app by hand". Now every state part 03 can reach
+// has one sentence and an action that resumes from that step with the app already made.
+//
+// Four layers, DB-free and network-free:
+//   1. modules/provisioning/github-setup.js — pickUpFor (what the action does, for EVERY
+//      status × app × verified-facts shape), mintGuard (reuse or refuse, never a second
+//      attempt once GitHub approved one), and the checking window a check request re-opens.
+//   2. the runner — a stopped sign-in is re-asked with the keys already placed and becomes
+//      'done'; a placement that throws after GitHub's conversion is a SPENT code (never
+//      re-queued); GitHub's 404 on a conversion drops the dead code.
+//   3. the REAL status route's answer run into the REAL page (seedSetup + the step renderers):
+//      every reachable state draws a sentence and an action, none a chore or "contact us".
+//   4. the page's own actions: pick-up posts to the pick-up route and watches again, Reopen
+//      GitHub goes through the mint route (which hands back the SAME state), and "Send it to
+//      the platform team" files a blocker without a secret.
+//
+// Run:  node --test tests/github_pick_up.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const GS = require(path.join(ROOT, 'modules', 'provisioning', 'github-setup.js'));
+const RUN = require(path.join(ROOT, 'scripts', 'gds', 'provision-github-setup.js'));
+const P = require(path.join(ROOT, 'scripts', 'gds', 'provision.js'));
+const HUB = fs.readFileSync(path.join(ROOT, 'modules', 'public-landing', 'public', 'projects.html'), 'utf8').replace(/\r\n/g, '\n');
+const SCRIPT = HUB.slice(HUB.lastIndexOf('<script>'), HUB.lastIndexOf('</script>'));
+
+const NOW = Date.parse('2026-10-09T12:00:00Z');
+const ago = (min) => new Date(NOW - min * 60000).toISOString();
+const SOON = new Date(NOW + 10 * 60000).toISOString();
+
+// ── 1. what picking it up does ──────────────────────────────────────────────
+
+test('pickUpFor: every attempt shape has its action, and none of them is "make another app"', () => {
+  const c = (status, slug, facts) => GS.githubChecklist(status, slug, facts);
+  const at = (row, status, facts = {}, verifying = false) => GS.pickUpFor(row, status, c(status, row && row.app_slug, facts), verifying, NOW);
+  assert.equal(at(null, null), null, 'no attempt: Connect GitHub is the first click, not a pick-up');
+  assert.equal(at({ attempts: 0 }, 'pending'), 'reopen', 'waiting on GitHub: post the SAME link again');
+  assert.equal(at({ attempts: 0 }, 'expired'), 'fresh', 'lapsed before approval: nothing was made, a new link is safe');
+  assert.equal(at({ attempts: 0 }, 'error'), 'fresh', 'the runner never took it up: nothing was made');
+  assert.equal(at({ attempts: 1 }, 'code_received'), null, 'in flight: nothing to pick up');
+  assert.equal(at({ attempts: 1 }, 'converting'), null);
+  // GitHub approved; the conversion stopped
+  assert.equal(at({ attempts: 2, github_code: 'C', created_at: ago(20) }, 'error'), 'convert', 'the code is still young: convert it again');
+  assert.equal(at({ attempts: 2, github_code: 'C', created_at: ago(61) }, 'error'), 'operator', 'past GitHub\'s hour the code is dead');
+  assert.equal(at({ attempts: 2, github_code: null, created_at: ago(5) }, 'error'), 'operator', 'a spent code: the app exists, its keys never reached us');
+  // the app exists with its keys placed
+  const app = { attempts: 1, app_id: 5, app_slug: 'mercury-app' };
+  assert.equal(at(app, 'error'), 'check', 'sign-in unconfirmed, the runner stopped asking: ask again');
+  assert.equal(at(app, 'error', {}, true), null, 'still asking: nothing to press');
+  assert.equal(at(app, 'done'), 'check', 'install never confirmed and the window closed: check again');
+  assert.equal(at(app, 'done', { installedAt: ago(1) }), 'check', 'device flow still off after the window: check again');
+  assert.equal(at(app, 'done', { installedAt: ago(1), deviceFlowAt: ago(1) }), null, 'all four ticked: nothing left');
+});
+
+test('mintGuard: a waiting link is handed back, and once GitHub approved an app no new link is made', () => {
+  assert.equal(GS.mintGuard(null, NOW), null);
+  assert.deepEqual(GS.mintGuard({ status: 'pending', state: 'S', expires_at: SOON }, NOW), { reuse: 'S', expiresAt: SOON });
+  assert.equal(GS.mintGuard({ status: 'pending', state: 'S', expires_at: ago(1) }, NOW), null, 'lapsed: mint fresh');
+  assert.equal(GS.mintGuard({ status: 'error', attempts: 0 }, NOW), null, 'nothing made: mint fresh');
+  for (const row of [{ status: 'error', attempts: 1, app_id: 5 }, { status: 'done', attempts: 1, app_id: 5 }, { status: 'error', attempts: 3, app_id: null }]) {
+    assert.equal(GS.mintGuard(row, NOW).refuse, 'app_exists', JSON.stringify(row));
+  }
+  assert.equal(GS.mintGuard({ status: 'converting', attempts: 1 }, NOW).refuse, 'github_in_progress');
+});
+
+test('a check request re-opens the runner\'s checking window, like an install report', () => {
+  const settled = { resolved_at: ago(5 * 60) };
+  assert.equal(GS.stillVerifying(settled, {}, NOW), false);
+  assert.equal(GS.stillVerifying(settled, { checkRequestedAt: ago(1) }, NOW), true);
+  assert.equal(GS.SETUP_EVENTS.checkRequested, 'github-app-check-requested');
+});
+
+// ── 2. the runner ───────────────────────────────────────────────────────────
+
+const STOPPED = { id: 21, instance_id: 42, created_at: ago(300), requested_by: 7, status: 'error', slug: 'mercury', port: 4100, target_ref: 'acme/mercury', hosting_shape: 'co-tenant', instance_status: 'active' };
+function runnerDeps({ healthz, facts = [] }) {
+  const resolved = [], events = [], cmds = [];
+  return {
+    resolved, events, cmds,
+    deps: {
+      apply: true, log: () => {}, fetchImpl: async () => ({ status: 500, ok: false, json: async () => ({}) }),
+      db: { query: async (sql) => (/WITH latest AS/.test(sql) ? { rows: [STOPPED] } : /FROM provisioning_events/.test(sql) ? { rows: facts } : { rows: [] }) },
+      exec: (cmd) => { cmds.push(cmd); return { ok: true, stdout: /healthz/.test(cmd) ? healthz : '' }; },
+      provisioning: {
+        resolveOAuthManifest: async (_db, id, status, patch) => { resolved.push({ id, status, patch }); },
+        recordEvent: async (_db, e) => { events.push(e); },
+      },
+    },
+  };
+}
+
+test('a stopped sign-in is asked again with the keys already placed, and becomes done — the same attempt', async () => {
+  const w = runnerDeps({ healthz: '{"ok":true,"auth_configured":true}' });
+  const out = await RUN.verifyGithubAppSetups(w.deps);
+  assert.equal(out.signIn, 1);
+  assert.ok(w.cmds.includes('curl -sS --max-time 5 http://127.0.0.1:4100/api/bongos/healthz'), 'the JSON health read, as the placement uses (authHealthzCmd)');
+  assert.equal(w.cmds[0], P.authHealthzCmd({ port: 4100 }), 'byte-for-byte the placement probe');
+  assert.deepEqual(w.resolved, [{ id: 21, status: 'done', patch: { github_code: null } }], 'attempt 21 itself — nothing new is made');
+  assert.ok(w.events.some((e) => e.event === 'oauth-manifest-done'));
+  // still not answering: nothing changes, the next tick asks again
+  const no = runnerDeps({ healthz: '{"ok":true,"auth_configured":false}' });
+  assert.equal((await RUN.verifyGithubAppSetups(no.deps)).signIn, 0);
+  assert.deepEqual(no.resolved, []);
+  // an attempt that is 'done' is never re-asked
+  const done = runnerDeps({ healthz: '{"auth_configured":true}', facts: [{ event: 'github-app-installed', at: ago(1) }, { event: 'github-app-device-flow', at: ago(1) }] });
+  STOPPED.status = 'done';
+  try { await RUN.verifyGithubAppSetups(done.deps); } finally { STOPPED.status = 'error'; }
+  assert.deepEqual(done.cmds, [], 'a finished attempt costs nothing');
+});
+
+const INST = { id: 1, slug: 'mercury', hosting_shape: 'co-tenant', status: 'active', owner_builder_id: 7, port: 3003, db_name: 'mercury', domain: 'mercury.example.com' };
+const CREDS = { clientId: 'Iv1.abcdef0123456789', clientSecret: 'z'.repeat(40), appId: 9, appSlug: 'm-app' };
+
+test('keys that fail to land after GitHub\'s conversion are a SPENT code: never re-queued, the app named for the platform team', async () => {
+  const r = await P.placeManifestCreds(INST, { github_code: 'C', attempts: 1 }, {
+    apply: true, log: () => {}, convertManifestCode: async () => CREDS,
+    exec: () => ({ ok: true, stdout: '' }), writeFile: () => { throw new Error('ssh: connection reset'); },
+  });
+  assert.equal(r.ok, false);
+  assert.equal(r.codeSpent, true, 'the code is burned: a retry would 404 forever');
+  assert.match(r.error, /GitHub made the app m-app, but placing its keys failed: ssh: connection reset/);
+  assert.equal(r.appSlug, undefined, 'no slug on the row: a recorded slug reads as "keys placed"');
+  // …and the drain records it so: error, code dropped — pickUpFor then says 'operator', not 'convert'
+  let claims = 0; const resolved = [];
+  await P.drainOAuthManifests({
+    apply: true, log: () => {}, db: {}, exec: () => ({ ok: true, stdout: '' }), writeFile: () => { throw new Error('disk full'); },
+    convertManifestCode: async () => CREDS,
+    provisioning: {
+      claimNextOAuthManifest: async () => (claims++ === 0 ? { id: 31, instance_id: 1, github_code: 'C', attempts: 1 } : null),
+      getInstanceById: async () => INST, resolveOAuthManifest: async (_db, id, status, patch) => { resolved.push({ id, status, patch }); }, recordEvent: async () => {},
+    },
+  });
+  assert.equal(resolved.length, 1);
+  assert.equal(resolved[0].status, 'error');
+  assert.equal(resolved[0].patch.github_code, null);
+  assert.equal(GS.pickUpFor({ attempts: 1, github_code: null, created_at: ago(1) }, 'error', GS.githubChecklist('error', null), false, NOW), 'operator');
+});
+
+test('GitHub\'s 404 on a conversion drops the dead code; any other failure keeps it for a pick-up', async () => {
+  const drain = async (message) => {
+    let claims = 0; const resolved = [];
+    await P.drainOAuthManifests({
+      apply: true, log: () => {}, db: {}, exec: () => ({ ok: true }), writeFile: () => ({ ok: true }),
+      convertManifestCode: async () => { throw new Error(message); },
+      provisioning: {
+        claimNextOAuthManifest: async () => (claims++ === 0 ? { id: 32, instance_id: 1, github_code: 'C', attempts: 1 } : null),
+        getInstanceById: async () => INST, resolveOAuthManifest: async (_db, id, status, patch) => { resolved.push({ status, patch }); }, recordEvent: async () => {},
+      },
+    });
+    return resolved[0];
+  };
+  const dead = await drain('GitHub manifest conversion failed: Not Found');
+  assert.equal(dead.status, 'error');
+  assert.equal(dead.patch.github_code, null);
+  const flaky = await drain('GitHub manifest conversion failed: HTTP 502');
+  assert.equal(flaky.status, 'error');
+  assert.ok(!('github_code' in flaky.patch), 'the code may still convert: "Pick up where it stopped" re-queues it');
+});
+
+// ── 3. the REAL status route into the REAL page ─────────────────────────────
+
+const provisioning = require(path.join(ROOT, 'modules', 'provisioning', 'provisioning.js'));
+let attempt = null;
+provisioning.getOAuthManifestByState = async (_db, state) => (state === 'S1' ? attempt : null);
+provisioning.getInstanceById = async () => ({ id: 42, owner_builder_id: 7, slug: 'mercury', domain: 'mercury.example.com', target_ref: 'acme/mercury', status: 'active' });
+let eventRows = [];
+const realQuery = { query: async () => ({ rows: eventRows }) };
+const api = require(path.join(ROOT, 'src', 'module-api.js'));
+api.pool.query = realQuery.query;   // the one read the status route makes: the verified facts
+const express = require('express');
+const app = express();
+app.use('/api/bongos', require(path.join(ROOT, 'modules', 'provisioning', 'routes', 'github-setup.js'))());
+
+const RS = SCRIPT.indexOf('    /* The four GitHub steps of part 03');
+const RE = SCRIPT.indexOf('    var STEP_RENDERERS = {', RS);
+const SS = SCRIPT.indexOf('    /* the checklist the server derived (task 1004649)');
+const SE = SCRIPT.indexOf('    function setupOpen() {', SS);
+const AS = SCRIPT.indexOf('    /* ── Pick up where it stopped (task 1004652).');
+const AE = SCRIPT.indexOf('    function startManifest(btn) {', AS);
+
+test('the page regions are findable (a rename must fail loudly)', () => {
+  assert.ok(RS > 0 && RE > RS && SS > 0 && SE > SS && AS > 0 && AE > AS);
+});
+
+const esc = (x) => String(x).replace(/[&<>"']/g, (ch) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[ch]));
+function page(extra = {}) {
+  const sandbox = {
+    live: { manifest: null, manifestMsg: '', manifestCode: '', manifestFailure: null, appSlug: null, appOrg: null, setup: null, installUrl: null, instStatus: 'active', addrReady: true, pickUp: null, verifying: false, askedPlatform: false },
+    state: { name: 'Mercury', slug: 'mercury', owner: 'acme', repo: 'mercury' }, autoOpenArmed: false,
+    resolvedDomain: () => 'mercury.example.com', apexBase: () => 'example.com', esc,
+    GH_ICON: '', manualOauthDetails: () => '<details>manual</details>', projectPageLink: (t) => t, autoOpenTick: () => '',
+    progressMarkup: (a, b, note) => `<prog>${note}</prog>`, encodeURIComponent, JSON,
+    ...extra,
+  };
+  vm.createContext(sandbox);
+  vm.runInContext(`${SCRIPT.slice(RS, RE)}\n${SCRIPT.slice(SS, SE)}\n${SCRIPT.slice(AS, AE)}`, sandbox);
+  return sandbox;
+}
+// what the page's poll does with one answer (pollManifest's tick, minus the timer)
+function seedFrom(sb, d) {
+  sb.live.appSlug = d.app_slug || null;
+  vm.runInContext(`seedSetup(${JSON.stringify(d.checklist)}, ${JSON.stringify(d.install_url)}, ${JSON.stringify(d)})`, sb);
+  sb.live.manifest = d.ready ? 'done' : d.status;
+  sb.live.manifestFailure = d.failure || null;
+}
+const ROWS = ['renderStepOauthApp', 'renderStepAppInstall', 'renderStepFirstSignIn', 'renderStepDeviceFlow'];
+const CHORE = /\/contact|Contact us|delete it|Developer settings → GitHub Apps\) so|Try again anyway|Start the setup again|by hand/;
+
+// every shape the status derivation can reach, as rows the real route reads
+const SHAPES = [
+  ['waiting on GitHub', { status: 'pending', attempts: 0, expires_at: SOON }, []],
+  ['link lapsed', { status: 'pending', attempts: 0, expires_at: ago(1) }, []],
+  ['runner never took it up', { status: 'error', attempts: 0, expires_at: ago(1) }, []],
+  ['approved, converting', { status: 'converting', attempts: 1, expires_at: ago(1) }, []],
+  ['conversion stopped, code young', { status: 'error', attempts: 3, github_code: 'C', created_at: ago(15), expires_at: ago(1), resolved_at: ago(10) }, []],
+  ['conversion stopped, code spent', { status: 'error', attempts: 1, github_code: null, created_at: ago(15), expires_at: ago(1), resolved_at: ago(10) }, []],
+  ['sign-in unconfirmed, re-asking', { status: 'error', attempts: 1, app_id: 5, app_slug: 'mercury-app', created_at: ago(15), resolved_at: ago(10) }, []],
+  ['sign-in unconfirmed, window over', { status: 'error', attempts: 1, app_id: 5, app_slug: 'mercury-app', created_at: ago(300), resolved_at: ago(290) }, []],
+  ['signed in, install unverified, checking', { status: 'done', attempts: 1, app_id: 5, app_slug: 'mercury-app', created_at: ago(15), resolved_at: ago(10) }, []],
+  ['signed in, install never confirmed, window over', { status: 'done', attempts: 1, app_id: 5, app_slug: 'mercury-app', created_at: ago(300), resolved_at: ago(290) }, []],
+  ['installed, device flow off, window over', { status: 'done', attempts: 1, app_id: 5, app_slug: 'mercury-app', created_at: ago(300), resolved_at: ago(290) }, [{ event: 'github-app-installed', at: ago(280) }]],
+  ['all four ticked', { status: 'done', attempts: 1, app_id: 5, app_slug: 'mercury-app', created_at: ago(300), resolved_at: ago(290) }, [{ event: 'github-app-installed', at: ago(280) }, { event: 'github-app-device-flow', at: ago(280) }]],
+];
+
+async function statusSays(row, events) {
+  attempt = { id: 99, instance_id: 42, requested_by: 7, state: 'S1', ...row };
+  eventRows = events;
+  const server = app.listen(0);
+  await new Promise((r) => server.once('listening', r));
+  try {
+    const res = await fetch(`http://127.0.0.1:${server.address().port}/api/bongos/provisioning/github-app/status?state=S1`);
+    return await res.json();
+  } finally { server.close(); }
+}
+
+test('every state the setup can reach: the REAL status answer draws a sentence and an action — never a chore, never "contact us"', async (t) => {
+  // the page reads NOW from the real clock; age the rows against it
+  const shift = Date.now() - NOW;
+  const aged = (row) => Object.fromEntries(Object.entries(row).map(([k, v]) => [k, /_at$/.test(k) && v ? new Date(Date.parse(v) + shift).toISOString() : v]));
+  const seen = {};
+  for (const [name, row, events] of SHAPES) {
+    const d = await statusSays(aged(row), events.map((e) => ({ ...e, at: new Date(Date.parse(e.at) + shift).toISOString() })));
+    assert.equal(d.ok, true, name);
+    const sb = page();
+    seedFrom(sb, d);
+    const html = ROWS.map((f) => vm.runInContext(`${f}()`, sb)).join('\n');
+    seen[name] = { pick: d.pick_up, html };
+    assert.doesNotMatch(html, CHORE, `${name}: no manual chore and no "contact us"`);
+    // a stopped step always carries the action that fixes it
+    for (const li of html.split('\n').filter((x) => /class="sstopped/.test(x))) {
+      assert.match(li, /data-action="(pick-up|manifest-start|ask-platform)"/, `${name}: a stopped step has its button — ${li.slice(0, 120)}`);
+    }
+    // a pick-up the server offers is on the page
+    if (d.pick_up === 'check' || d.pick_up === 'convert') assert.match(html, /data-action="pick-up"/, `${name}: ${d.pick_up} is offered`);
+    if (d.pick_up === 'operator') assert.match(html, /data-action="ask-platform"/, `${name}: the platform team is one click away`);
+    if (d.pick_up === 'reopen') assert.match(html, /data-action="reopen-github"/, `${name}: the same link can be reopened`);
+    // a new link is offered ONLY where nothing was made on GitHub
+    if (/data-action="manifest-start"/.test(html)) assert.ok(d.pick_up === 'fresh', `${name}: Connect GitHub is offered only when no app exists (pick_up=${d.pick_up})`);
+  }
+  assert.equal(seen['waiting on GitHub'].pick, 'reopen');
+  assert.equal(seen['link lapsed'].pick, 'fresh');
+  assert.equal(seen['conversion stopped, code young'].pick, 'convert');
+  assert.equal(seen['conversion stopped, code spent'].pick, 'operator');
+  assert.equal(seen['sign-in unconfirmed, re-asking'].pick, null);
+  assert.match(seen['sign-in unconfirmed, re-asking'].html, /We’re asking it again/);
+  assert.equal(seen['sign-in unconfirmed, window over'].pick, 'check');
+  assert.match(seen['signed in, install never confirmed, window over'].html, /GitHub stopped before the app was installed on your repo\. Nothing is lost, and no second app will be made\./, 'the mockup\'s sentence, from the real read');
+  assert.match(seen['installed, device flow off, window over'].html, /Turned it on\? Check again/);
+  assert.equal(seen['all four ticked'].pick, null);
+  assert.doesNotMatch(seen['all four ticked'].html, /sstopped|data-action="pick-up"/);
+  t.diagnostic(Object.entries(seen).map(([k, v]) => `${k}: ${v.pick}`).join(' · '));
+});
+
+// ── 4. the page's own actions ───────────────────────────────────────────────
+
+function actions({ pickUp, answer, manifestState = null, blockerStatus = 201 }) {
+  const calls = { fetched: [], polled: [], progress: [], started: 0, renders: 0 };
+  const sb = page({
+    API: '/api/bongos', instanceId: 42, manifestState, pollTimer: null, lastStepsHtml: 'x', manifestStartedAt: 1700000000000, ghTab: null,
+    fetch: async (url, init) => {
+      calls.fetched.push({ url, init });
+      if (/\/blockers$/.test(url)) return { ok: blockerStatus < 300, status: blockerStatus, json: async () => ({}) };
+      return { ok: true, status: 200, json: async () => answer };
+    },
+    rememberManifest: () => {}, renderSteps: () => { calls.renders++; },
+    pollManifest: (s) => calls.polled.push(s), startProgress: (id) => calls.progress.push(id),
+    startManifest: () => { calls.started++; },
+  });
+  sb.live.pickUp = pickUp;
+  return { sb, calls };
+}
+const settle = () => new Promise((r) => setTimeout(r, 20));
+const btn = () => ({ tagName: 'BUTTON', disabled: false, textContent: '' });
+
+test('pick-up posts to the pick-up route, seeds its fresh read, and watches again', async () => {
+  const answer = { ok: true, action: 'convert', status: 'code_received', failure: null, checklist: GS.githubChecklist('code_received', null), install_url: null, verifying: false, pick_up: null };
+  const { sb, calls } = actions({ pickUp: 'convert', answer, manifestState: 'S1' });
+  vm.runInContext('pickUpSetup', sb)(btn());
+  await settle();
+  assert.equal(calls.fetched.length, 1);
+  assert.equal(calls.fetched[0].url, '/api/bongos/provisioning/instances/42/github-app/pick-up');
+  assert.equal(calls.fetched[0].init.method, 'POST');
+  assert.equal(calls.started, 0, 'no new link is minted');
+  assert.equal(sb.live.manifest, 'code_received', 'the step moves on at once');
+  assert.equal(sb.live.pickUp, null);
+  assert.deepEqual(calls.polled, ['S1'], 'the attempt\'s own poll runs again');
+  // without the state (a reload, another device) the instance read watches instead
+  const other = actions({ pickUp: 'check', answer: { ...answer, action: 'check', status: 'error', verifying: true } });
+  vm.runInContext('pickUpSetup', other.sb)(btn());
+  await settle();
+  assert.deepEqual(other.calls.progress, [42]);
+  assert.equal(other.sb.live.verifying, true);
+});
+
+test('Reopen GitHub and a lapsed link go through the mint route (which hands back the SAME waiting state); a refused pick-up says so', async () => {
+  for (const pickUp of ['reopen', 'fresh']) {
+    const { sb, calls } = actions({ pickUp, answer: {} });
+    vm.runInContext('pickUpSetup', sb)(btn());
+    await settle();
+    assert.equal(calls.started, 1, pickUp);
+    assert.equal(calls.fetched.length, 0, `${pickUp}: the pick-up route is not asked`);
+  }
+  const r = actions({ pickUp: null, answer: {} });
+  vm.runInContext('reopenGithub', r.sb)(btn());
+  assert.equal(r.calls.started, 1);
+  // a refusal (409) re-enables the button with a plain line
+  const refused = actions({ pickUp: 'check', answer: { ok: false } });
+  const b = btn();
+  vm.runInContext('pickUpSetup', refused.sb)(b);
+  await settle();
+  assert.equal(b.disabled, false);
+  assert.match(b.textContent, /That didn’t go through\. Try again/);
+});
+
+test('"Send it to the platform team" files one blocker for the attempt, with no secret, and the step says it was sent', async () => {
+  const { sb, calls } = actions({ pickUp: 'operator', answer: {} });
+  vm.runInContext('pickUpSetup', sb)(btn());
+  await settle();
+  const filed = calls.fetched.find((c) => /\/blockers$/.test(c.url));
+  assert.ok(filed, 'POST /api/bongos/blockers');
+  assert.equal(filed.url, '/api/bongos/blockers');
+  const body = JSON.parse(filed.init.body);
+  assert.equal(body.source, 'github-setup');
+  assert.equal(body.source_ref, 'instance-42-1700000000000', 'one per attempt: a second press is the same blocker');
+  assert.match(body.body_md, /Project 42/);
+  assert.doesNotMatch(filed.init.body, /state|github_code|secret=|Iv1\./i, 'no token, code or secret');
+  assert.equal(sb.live.askedPlatform, true);
+  assert.ok(calls.renders > 0);
+  const failed = actions({ pickUp: 'operator', answer: {}, blockerStatus: 500 });
+  vm.runInContext('askPlatform', failed.sb)(btn());
+  await settle();
+  assert.equal(failed.sb.live.askedPlatform, 'failed');
+});

package/tests/projects_hub_pre_uat.mjs

@@ -213,8 +213,9 @@ test('the manifest step acknowledges code_received, offers a restart after a sta
   // 'converting' is the same stage — it used to fall through to "waiting for approval" (task 1004572)
   assert.match(SCRIPT, /if \(live\.manifest === 'code_received' \|\| live\.manifest === 'converting'\)/, 'GitHub’s half is acknowledged');
   assert.match(SCRIPT, /Approved on GitHub\. The platform is placing the app’s keys on your project/);
-  assert.match(SCRIPT, /manifestStale \? '<button type="button" class="linklike" data-action="manifest-start">/, 'a stalled wait gets a restart door');
-  assert.match(SCRIPT, /\(Date\.now\(\) - manifestStartedAt\) > 90000/, 'after ~90 seconds');
+  // the way back is the SAME attempt, on show from the start — never a new link after 90s (task 1004652)
+  assert.match(SCRIPT, /data-action="reopen-github">No GitHub tab\? Reopen GitHub/, 'a waiting step can reopen GitHub');
+  assert.doesNotMatch(SCRIPT, /manifestStale|> 90000/, 'no 90-second restart door left');
   assert.match(SCRIPT, /function rememberManifest\(stateToken, status, appSlug\)/);
   assert.match(SCRIPT, /rememberManifest\(d\.state, 'pending'\)/, 'the token is remembered when GitHub is opened');
   assert.match(SCRIPT, /if \(created\.manifest\) \{ live\.manifest = created\.manifest; live\.appSlug = created\.app_slug \|\| null; \}/, 'enter() re-seeds the step');

package/tests/provisioning_github_app_routes.mjs

@@ -29,6 +29,9 @@ provisioning.getOAuthManifestByState = async (_db, state) => (state === 'GOODSTA
   ? { id: 99, instance_id: 42, requested_by: 7, status: 'pending', expires_at: new Date(Date.now() + 600000).toISOString() }
   : null);
 provisioning.attachManifestCode = async (_db, id, code) => ({ id, status: 'code_received', github_code: code });
+// the latest attempt the mint guard and the pick-up route read (task 1004652); none by default
+let latest = null;
+provisioning.getLatestOAuthManifestForInstance = async () => latest;
 
 // A branding with a known publicOrigin so mothershipOrigin() resolves deterministically.
 const branding = require(`${ROOT}/src/branding.js`);
@@ -281,6 +284,76 @@ console.log('\nGET /provisioning/github-app/status (the page poll → auto-open
   t('missing state → 400', res.status === 400, `status=${res.status}`);
 }
 
+console.log('\nNever a second app (task 1004652): the mint guard and "Pick up where it stopped":');
+{
+  const mint = async () => fetch(`${base}/provisioning/instances/42/github-app`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: '{}' });
+  const soon = new Date(Date.now() + 600000).toISOString();
+  // a link still waiting on GitHub is handed back — the SAME state, no new attempt row
+  stored = null;
+  latest = { id: 70, instance_id: 42, state: 'WAITINGSTATE', status: 'pending', attempts: 0, expires_at: soon, created_at: new Date().toISOString() };
+  let res = await mint();
+  let j = await res.json();
+  t('a waiting link is reopened, not re-minted: same state, same expiry, no new row', res.status === 200 && j.state === 'WAITINGSTATE' && j.expires_at === soon && stored === null && j.post_url === 'https://github.com/settings/apps/new?state=WAITINGSTATE', JSON.stringify(j));
+  // GitHub already made the app (keys placed, sign-in unconfirmed): refused, nothing minted
+  for (const row of [
+    { id: 71, instance_id: 42, state: 'S71', status: 'error', attempts: 1, app_id: 5, app_slug: 'mercury-app', expires_at: soon },
+    { id: 72, instance_id: 42, state: 'S72', status: 'done', attempts: 1, app_id: 5, app_slug: 'mercury-app', expires_at: soon },
+    { id: 73, instance_id: 42, state: 'S73', status: 'error', attempts: 2, app_id: null, app_slug: null, expires_at: soon },
+  ]) {
+    stored = null; latest = row;
+    res = await mint(); j = await res.json();
+    t(`an attempt GitHub approved (${row.status}, attempts ${row.attempts}) refuses a new link: 409 app_exists, nothing minted`, res.status === 409 && j.error.code === 'app_exists' && stored === null, JSON.stringify(j));
+  }
+  stored = null; latest = { id: 74, instance_id: 42, state: 'S74', status: 'converting', attempts: 1, expires_at: soon };
+  res = await mint(); j = await res.json();
+  t('an attempt the runner is converting refuses a new link: 409 github_in_progress', res.status === 409 && j.error.code === 'github_in_progress' && stored === null, JSON.stringify(j));
+  // nothing was made on GitHub: a fresh link is minted
+  for (const row of [
+    { id: 75, instance_id: 42, state: 'S75', status: 'pending', attempts: 0, expires_at: new Date(Date.now() - 1000).toISOString() },
+    { id: 76, instance_id: 42, state: 'S76', status: 'error', attempts: 0, expires_at: soon },
+  ]) {
+    stored = null; latest = row;
+    res = await mint(); j = await res.json();
+    t(`nothing made on GitHub (${row.status}, attempts ${row.attempts}) → a fresh state is minted`, res.status === 200 && stored && stored.state === j.state && j.state !== row.state, JSON.stringify(j));
+  }
+
+  // the pick-up route: 'convert' re-queues the SAME attempt with the code it holds
+  const queries = [];
+  const pg = require(`${ROOT}/src/module-api.js`).pool;
+  const prevQuery = pg.query;
+  pg.query = async (sql, params) => { queries.push({ sql, params }); return { rows: /UPDATE provisioning_oauth_manifests/.test(sql) ? [{ id: params[0] }] : [] }; };
+  const pickUp = async () => fetch(`${base}/provisioning/instances/42/github-app/pick-up`, { method: 'POST' });
+  latest = { id: 80, instance_id: 42, state: 'S80', status: 'error', attempts: 1, github_code: 'CODE', app_id: null, app_slug: null, created_at: new Date(Date.now() - 10 * 60000).toISOString(), expires_at: soon };
+  const before = reported.length;
+  stored = null;
+  res = await pickUp(); j = await res.json();
+  const requeue = queries.find((q) => /UPDATE provisioning_oauth_manifests/.test(q.sql));
+  t("pick-up 'convert' re-queues attempt 80 itself (status code_received, attempts reset), mints nothing", res.status === 200 && j.action === 'convert' && requeue && requeue.params[0] === 80 && /status = 'code_received', attempts = 0/.test(requeue.sql) && /github_code IS NOT NULL/.test(requeue.sql) && stored === null, JSON.stringify(j));
+  // 'check': keys placed, the runner's window closed → a check request, no new attempt
+  queries.length = 0;
+  latest = { id: 81, instance_id: 42, state: 'S81', status: 'error', attempts: 1, app_id: 5, app_slug: 'mercury-app', created_at: new Date(Date.now() - 5 * 3600000).toISOString(), resolved_at: new Date(Date.now() - 4 * 3600000).toISOString(), expires_at: soon };
+  res = await pickUp(); j = await res.json();
+  const asked = reported.slice(before).filter((e) => e.event === 'github-app-check-requested');
+  t("pick-up 'check' records one check request for the project and writes no attempt", res.status === 200 && j.action === 'check' && asked.length === 1 && asked[0].instanceId === 42 && !queries.some((q) => /UPDATE|INSERT/.test(q.sql)) && stored === null, JSON.stringify(j));
+  // nothing the route itself can pick up: 409 naming the page's own action
+  for (const [row, action] of [
+    [{ id: 82, instance_id: 42, state: 'S82', status: 'pending', attempts: 0, expires_at: soon }, 'reopen'],
+    [{ id: 83, instance_id: 42, state: 'S83', status: 'error', attempts: 2, github_code: null, app_id: null, created_at: new Date().toISOString(), expires_at: soon }, 'operator'],
+  ]) {
+    latest = row;
+    res = await pickUp(); j = await res.json();
+    t(`pick-up on '${action}' is the page's own: 409 nothing_to_pick_up, action named`, res.status === 409 && j.error.code === 'nothing_to_pick_up' && j.error.action === action, JSON.stringify(j));
+  }
+  // another builder's project is a 404, like a missing one
+  const prevInst = provisioning.getInstanceById;
+  provisioning.getInstanceById = async () => ({ id: 42, owner_builder_id: 8, slug: 'mercury', domain: 'mercury.example.com', status: 'active' });
+  res = await pickUp();
+  t('pick-up on someone else’s project → 404', res.status === 404, `status=${res.status}`);
+  provisioning.getInstanceById = prevInst;
+  pg.query = prevQuery;
+  latest = null;
+}
+
 console.log('\nparseId contract (the (req,res) signature — a bad id is a clean 400, not a 500):');
 {
   const res = await fetch(`${base}/provisioning/instances/not-a-number/github-app`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: '{}' });