@webship.co/workspace 1.0.3 → 1.0.5

package/core/docs/releases.md

@@ -1,6 +1,6 @@
 # Releases
 
-Every package is versioned together: `@webship.co/workspace` (the core) and every `@webship.co/workspace-<name>`. Versions so far: 1.0.0-alpha1 (the first publish), 1.0.0-beta1, 1.0.0-beta2, 1.0.0-rc1, 1.0.0, 1.0.1 (the core and the git, ide and graph plugins only), 1.0.2, 1.0.3 (the core only).
+Every package is versioned together: `@webship.co/workspace` (the core) and every `@webship.co/workspace-<name>`. Versions so far: 1.0.0-alpha1 (the first publish), 1.0.0-beta1, 1.0.0-beta2, 1.0.0-rc1, 1.0.0, 1.0.1 (the core and the git, ide and graph plugins only), 1.0.2, 1.0.3, 1.0.4 and 1.0.5 (the core only).
 
 ## How a change lands
 

package/core/scripts/args/arg-website.sh

@@ -1,14 +1,14 @@
 #!/usr/bin/env bash
 
 # The Website project template (drupal/website) is installed by the Webship
-# installer, which offers the three Webship site templates. Pick one.
+# installer, which offers the five site templates the project ships. Pick one.
 
 argparse "$@" <<EOF || exit 1
 parser.add_argument('PROJECT_NAME',
                     help='The name of the project. It becomes https://<PROJECT_NAME>.ddev.site')
 parser.add_argument('-t', '--template',
                     default="website_starter",
-                    choices=['website_starter', 'webship_starter', 'webship_portal'],
+                    choices=['website_starter', 'webship_starter', 'webship_portal', 'webapi_starter', 'webships_starter'],
                     help='The site template the Webship installer installs [default %(default)s].')
 parser.add_argument('-a', '--add-users',
                     action='store_true',

package/core/scripts/functions/fun-build-distribution.sh

@@ -8,6 +8,44 @@ function composer_install_retry() {
   ddev composer install --no-interaction ;
 }
 
+# composer create-project in the current (empty) project folder, for every build family:
+#   composer_create_project <template>:<version> [more create-project options]
+#
+# A release line may need two things before its first install, or composer cannot resolve it at all:
+#   site_composer_requires  root requirements, e.g. an alias. a Drupal 10 line may ask for a package
+#                           that moved to Drupal 11, so the line aliases the last Drupal 10 release.
+#   site_patches_ignore     "<package> <patch-url>" pairs that webship/patches declares and the release
+#                           already contains, so applying the patch fails (patches-ignore, added to composer.json).
+# Both are declared by the builder as bash arrays. A builder that declares neither installs in one step as before.
+# Returns 1 when the codebase could not be installed; the caller says which build stops and where.
+function composer_create_project() {
+  local project_template="$1" ; shift ;
+  site_requires=("${site_composer_requires[@]}") ;
+  site_ignores=("${site_patches_ignore[@]}") ;
+  if [ -n "${site_requires[0]:-}${site_ignores[0]:-}" ] ; then
+    ddev composer create-project ${project_template} . --no-interaction --no-install --no-scripts "$@" || return 1 ;
+    if [ -n "${site_requires[0]:-}" ] ; then
+      ddev composer require "${site_requires[@]}" --no-update --no-interaction || return 1 ;
+    fi
+    if [ -n "${site_ignores[0]:-}" ] ; then
+      patches_ignore_json=$(python3 -c 'import sys, json; d = {}; [d.setdefault("webship/patches", {}).setdefault(a.split(" ", 1)[0], []).append(a.split(" ", 1)[1]) for a in sys.argv[1:]]; print(json.dumps(d))' "${site_ignores[@]}") ;
+      ddev composer config --json extra.patches-ignore "${patches_ignore_json}" || return 1 ;
+    fi
+    if ! composer_install_retry || ! ddev composer run-script post-create-project-cmd ; then
+      echo "composer could not install ${project_template}." ;
+      return 1 ;
+    fi
+  elif ! ddev composer create-project ${project_template} . --no-interaction "$@" ; then
+    # When the project reached the install step, composer.json is already in place: install once more.
+    if [ -f composer.json ] && composer_install_retry && ddev composer run-script post-create-project-cmd ; then
+      echo "composer create-project needed a second install, which worked." ;
+    else
+      return 1 ;
+    fi
+  fi
+  return 0 ;
+}
+
 function build_distribution() {
   # Include distribution functions.
   source ${WORKSPACE_SCRIPTS}/functions/fun-distribution-${distribution_name}.sh || exit 1 ;
@@ -79,50 +117,21 @@ function build_distribution() {
 
   # A failed create-project (e.g. an upstream patch no longer applying) must stop the
   # build here — every step after this assumes a real vendor/autoload.php exists.
-  #
-  # A release line may need two things before its first install, or composer cannot resolve it at all:
-  #   site_composer_requires  root requirements, e.g. an alias. a Drupal 10 line may ask for a package
-  #                           that moved to Drupal 11, so the line aliases the last Drupal 10 release.
-  #   site_patches_ignore     "<package> <patch-url>" pairs that webship/patches declares and the release
-  #                           already contains, so applying the patch fails (patches-ignore, added to composer.json).
-  # Both are declared by the builder as bash arrays. A builder that declares neither installs in one step as before.
-  site_requires=("${site_composer_requires[@]}") ;
-  site_ignores=("${site_patches_ignore[@]}") ;
-  if [ -n "${site_requires[0]:-}${site_ignores[0]:-}" ] ; then
-    if ! ddev composer create-project ${distribution_project_template}:${site_version} . --no-interaction --no-install --no-scripts ${dev_stability:-} ; then
-      echo "composer create-project failed for ${distribution_project_template}:${site_version} — aborting, not installing." ;
-      cd ${WORKSPACE_ROOT}/${doc_name};
-      return 1 ;
-    fi
-    if [ -n "${site_requires[0]:-}" ] ; then
-      ddev composer require "${site_requires[@]}" --no-update --no-interaction || { cd ${WORKSPACE_ROOT}/${doc_name}; return 1 ; } ;
-    fi
-    if [ -n "${site_ignores[0]:-}" ] ; then
-      patches_ignore_json=$(python3 -c 'import sys, json; d = {}; [d.setdefault("webship/patches", {}).setdefault(a.split(" ", 1)[0], []).append(a.split(" ", 1)[1]) for a in sys.argv[1:]]; print(json.dumps(d))' "${site_ignores[@]}") ;
-      ddev composer config --json extra.patches-ignore "${patches_ignore_json}" || { cd ${WORKSPACE_ROOT}/${doc_name}; return 1 ; } ;
-    fi
-    if ! composer_install_retry || ! ddev composer run-script post-create-project-cmd ; then
-      echo "composer could not install ${distribution_project_template}:${site_version} — aborting, not installing." ;
-      cd ${WORKSPACE_ROOT}/${doc_name};
-      return 1 ;
-    fi
-  elif ! ddev composer create-project ${distribution_project_template}:${site_version} . --no-interaction ${dev_stability:-} ; then
-    # When the project reached the install step, composer.json is already in place: install once more.
-    if [ -f composer.json ] && composer_install_retry && ddev composer run-script post-create-project-cmd ; then
-      echo "composer create-project needed a second install, which worked." ;
-    else
-      echo "composer create-project failed for ${distribution_project_template}:${site_version} — aborting, not installing." ;
-      cd ${WORKSPACE_ROOT}/${doc_name};
-      return 1 ;
-    fi
+  if ! composer_create_project ${distribution_project_template}:${site_version} ${dev_stability:-} ; then
+    echo "composer create-project failed for ${distribution_project_template}:${site_version} — aborting, not installing." ;
+    cd ${WORKSPACE_ROOT}/${doc_name};
+    return 1 ;
   fi
 
   # Some project templates ship their own .ddev config that
   # changes the docroot/database/webimage packages after our initial ddev
   # config. Re-align: keep the database type we already provisioned, drop
-  # optional apt extras (avoids third-party repo key failures), keep our Node.js, and restart
-  # so the webserver serves the template's real docroot.
-  ddev config --database=mariadb:${provisioned_db_type} --webimage-extra-packages="" --nodejs-version=$(ddev_nodejs_version) ;
+  # optional apt extras (avoids third-party repo key failures), keep our Node.js and the PHP
+  # this build asked for (--php-version or the builder's site_php_version: composer resolved the
+  # codebase on it, so the template's own php_version would stop drush on the platform check),
+  # and restart so the webserver serves the template's real docroot.
+  ddev config --database=mariadb:${provisioned_db_type} --webimage-extra-packages="" \
+    ${php_version:+--php-version=${php_version}} --nodejs-version=$(ddev_nodejs_version) ;
   ddev_telemetry_off ;
   ddev_up restart ;
 

package/core/scripts/functions/fun-build-webships.sh

@@ -56,8 +56,9 @@ function webships_create_project() {
   # the installer finds them in recipes/ without Composer unpacking them.
   ddev composer config --json --merge extra.drupal-recipe-unpack.ignore '["drupal/webships_starter", "drupal/webapi_starter"]' ;
   # The project template ships its own .ddev/config.yaml, which pins an older Node.js:
-  # re-align to the workspace's Node.js (24, like Drupal core) and restart on it.
-  ddev config --nodejs-version=$(ddev_nodejs_version) --webimage-extra-packages="" ;
+  # re-align to the workspace's Node.js (24, like Drupal core) and to the PHP this build asked
+  # for, and restart on them.
+  ddev config --php-version=${PHP_VERSION:-${webships_php_version}} --nodejs-version=$(ddev_nodejs_version) --webimage-extra-packages="" ;
   ddev restart ;
 }
 

package/core/scripts/functions/fun-build-website.sh

@@ -29,7 +29,10 @@ function website_create_project() {
   ddev config --project-type=drupal --docroot=${distribution_webroot} --php-version=${PHP_VERSION:-${website_php_version}} --nodejs-version=$(ddev_nodejs_version) --project-name=${PROJECT_NAME} --auto ;
   ddev start -y ;
 
-  if ! ddev composer create-project "$1" . --no-interaction ; then
+  # composer_create_project (fun-build-distribution.sh) honours the builder's site_composer_requires
+  # and site_patches_ignore, so a requirement or a patch of the template that no longer resolves or
+  # applies can be worked around from the builder, as in build_distribution.
+  if ! composer_create_project "$1" ; then
     echo "composer create-project failed for $1 — aborting, nothing was installed." ;
     cd ${WORKSPACE_ROOT}/${doc_name};
     return 1 ;
@@ -39,9 +42,11 @@ function website_create_project() {
   ddev composer config minimum-stability dev ;
   ddev composer config prefer-stable true ;
 
-  # Keep the site templates as recipes, like drupal/website does: unpacking them
-  # into the root composer.json fails on aliased dev branches (the pending fixes).
-  ddev composer config --json --merge extra.drupal-recipe-unpack.ignore '["drupal/website_starter", "drupal/webship_starter", "drupal/webship_portal"]' ;
+  # The project template ships its own .ddev/config.yaml, which replaces the one written above and
+  # pins an older Node.js: re-align to the workspace's Node.js (24, like Drupal core) and to the PHP
+  # version this build asked for, and restart on them.
+  ddev config --php-version=${PHP_VERSION:-${website_php_version}} --nodejs-version=$(ddev_nodejs_version) ;
+  ddev restart ;
 }
 
 # -----------------------------------------------------------------------------
@@ -121,11 +126,11 @@ function build_website_project() {
 
   website_create_project "${distribution_project_template}:${site_version}" || return 1 ;
 
-  # The Website project requires the Webship installer and the three site
+  # The Website project requires the Webship installer and its five site
   # templates. Add whatever the published template does not require yet.
   local require_block missing=() ;
   require_block=$(sed -n '/"require": {/,/}/p' composer.json) ;
-  for package in "drupal/webship:12.0.x-dev" "drupal/website_starter:1.0.x-dev" "drupal/webship_starter:1.0.x-dev" "drupal/webship_portal:1.0.x-dev" ; do
+  for package in "drupal/webship:12.0.x-dev" "drupal/website_starter:1.0.x-dev" "drupal/webship_starter:1.0.x-dev" "drupal/webship_portal:1.0.x-dev" "drupal/webapi_starter:2.0.x-dev" "drupal/webships_starter:2.0.x-dev" ; do
     # The installer is drupal/webship or webship/webship; the pending fixes pin the latter.
     if [ "${package%%:*}" == "drupal/webship" ] && { [ "${WITH_PENDING_FIXES}" == 'yes' ] || echo "${require_block}" | grep -q '"webship/webship"' ; } ; then
       continue ;
@@ -136,7 +141,7 @@ function build_website_project() {
     fi
   done
 
-  # The codebase carries all three site templates, so it needs every pending fix.
+  # The codebase carries every site template, so it needs every pending fix.
   website_add_pending_fixes webship $(website_pending_fixes_for webship_portal) ;
 
   # Stage everything, then one full update, so no pin is held back by the lock file.
@@ -176,6 +181,13 @@ function build_website_site_template() {
 
   website_add_pending_fixes $(website_pending_fixes_for ${site_template_name}) ;
 
+  # Keep the site templates as recipes, like drupal/website does: unpacking them into the root
+  # composer.json fails on aliased dev branches (the pending fixes). Only here: the recommended
+  # project has no such list, and this runs before the require that writes the lock file.
+  # drupal/website carries its own list; merging into it after its lock file was written left
+  # duplicates and a lock file that `composer validate --check-lock` calls out of date.
+  ddev composer config --json --merge extra.drupal-recipe-unpack.ignore '["drupal/website_starter", "drupal/webship_starter", "drupal/webship_portal"]' ;
+
   if ! ddev composer require -W --no-interaction "drush/drush:^13" "${site_template_package}:${site_version}" ; then
     echo "composer require ${site_template_package}:${site_version} failed — aborting before the install." ;
     cd ${WORKSPACE_ROOT}/${doc_name};

package/core/scripts/functions/fun-distribution-cucumber.sh

@@ -11,9 +11,19 @@ function enable_cucumber_extra_components() {
   echo "Enable Cucumber extra components.";
 }
 
-# The default set of users `add_users` creates for Cucumber (--add-users).
+# The six work roles of Cucumber exist only once their role modules are on, and a
+# `drush site:install cucumber` build leaves them off. `add_users` runs this before it
+# creates the accounts, so each one can be given its role on a fresh build.
+function prepare_cucumber_users() {
+  echo "Enable the Cucumber role modules of the default users.";
+  ddev drush pm:enable --yes cucumber_user_role_developer cucumber_user_role_tester cucumber_user_role_analyst \
+    cucumber_user_role_designer cucumber_user_role_coordinator cucumber_user_role_product_owner ;
+}
+
+# The default set of users `add_users` creates for Cucumber (--add-users):
+# one account per work role, and one with the Admin role of the profile.
 function set_cucumber_users() {
-  users=(authenticated developer tester analyst coordinator product_owner administrator);
+  users=(authenticated developer tester analyst designer coordinator product_owner administrator);
   user_authenticated_name="Authenticated user";
   user_authenticated_mail="test.authenticated@webship.org";
   user_authenticated_password="dD.123123ddd";
@@ -30,6 +40,10 @@ function set_cucumber_users() {
   user_analyst_mail="test.analyst@webship.org";
   user_analyst_password="dD.123123ddd";
   user_analyst_role="analyst";
+  user_designer_name="Designer";
+  user_designer_mail="test.designer@webship.org";
+  user_designer_password="dD.123123ddd";
+  user_designer_role="designer";
   user_coordinator_name="Coordinator";
   user_coordinator_mail="test.coordinator@webship.org";
   user_coordinator_password="dD.123123ddd";
@@ -41,5 +55,6 @@ function set_cucumber_users() {
   user_administrator_name="Administrator";
   user_administrator_mail="test.administrator@webship.org";
   user_administrator_password="dD.123123ddd";
-  user_administrator_role="administrator";
+  # Cucumber has no `administrator` role: its administration role is Admin (`admin`).
+  user_administrator_role="admin";
 }

package/core/scripts/functions/fun-distribution-webship.sh

@@ -21,8 +21,10 @@ function set_webship_users() {
   user_content_editor_mail="test.content_editor@webship.org";
   user_content_editor_password="dD.123123ddd";
   user_content_editor_role="content_editor";
-  user_administrator_name="Webmaster";
-  user_administrator_mail="test.Webmaster@webship.org";
+  # Not "Webmaster": the installer's own account is `webmaster` (account.name in settings.yml), and
+  # user names are case-insensitive, so that account could never be created.
+  user_administrator_name="Administrator";
+  user_administrator_mail="test.administrator@webship.org";
   user_administrator_password="dD.123123ddd";
   user_administrator_role="administrator";
 }

package/core/scripts/functions/fun-distribution-website.sh

@@ -12,8 +12,10 @@ function set_website_users() {
   user_content_editor_mail="test.content_editor@webship.org";
   user_content_editor_password="dD.123123ddd";
   user_content_editor_role="content_editor";
-  user_administrator_name="Webmaster";
-  user_administrator_mail="test.webmaster@webship.org";
+  # Not "Webmaster": the installer's own account is `webmaster` (account.name in settings.yml), and
+  # user names are case-insensitive, so that account could never be created.
+  user_administrator_name="Administrator";
+  user_administrator_mail="test.administrator@webship.org";
   user_administrator_password="dD.123123ddd";
   user_administrator_role="administrator";
 }

package/core/scripts/functions/fun-users.sh

@@ -32,6 +32,17 @@ function add_users () {
 
   cd ${WORKSPACE_ROOT}/${doc_name}/${PROJECT_NAME}/${distribution_webroot}/;
 
+  # A distribution whose roles only exist once something is switched on (Cucumber's work roles
+  # come from their role modules) declares prepare_<distribution>_users next to its list. It runs
+  # here, so the accounts get their roles on a fresh build and from cmd-tools-add-users.sh alike.
+  if declare -f prepare_${distribution_name}_users > /dev/null ; then
+    if ! prepare_${distribution_name}_users ; then
+      echo "The roles of the default users could not be prepared — no user was added." ;
+      cd ${WORKSPACE_ROOT}/${doc_name};
+      return 1 ;
+    fi
+  fi
+
   for user in ${users[@]}
   do
     user_name="user_${user}_name";

package/core/scripts/tests/cmd-smoke-test.sh

@@ -8,7 +8,9 @@
 #                          prints usage and exits before any real work),
 #                          which exercises bootstrap.sh, parse_yaml, the
 #                          workspace + distribution configs and arg-*.sh
-#  3. workspace-name     — builder scripts must carry the "# workspace-name:"
+#  3. the last call      — the function a script ends by calling exists, and a builder that
+#                          ends with build_distribution has its install function
+#  4. workspace-name     — builder scripts must carry the "# workspace-name:"
 #                          header the dashboard shows in Build dropdowns
 #
 # Exit code: number of failing scripts (0 = all green).
@@ -78,6 +80,18 @@ for ws in "${workspaces[@]}" commands core/scripts; do
       done
     fi
 
+    # 3b. A builder that ends with build_distribution is installed by install_<distribution>_with_drush,
+    #     which build_distribution calls by name. A builder copied from another family can keep that last
+    #     line while its own family has no such function (the Website family installs in
+    #     build_website_project): build_distribution exists, so check 3 passes, and the build stops at the install.
+    if [ -z "$err" ] && grep -qE '^build_distribution ;$' "$f"; then
+      dist=$(grep -oE '^distribution_name="[a-z0-9_]+"' "$f" | head -1 | cut -d'"' -f2)
+      if [ -n "$dist" ] && ! grep -qE "^(function )?install_${dist}_with_drush ?\(\)" \
+           "${WORKSPACE_SCRIPTS}/functions/fun-distribution-${dist}.sh" 2>/dev/null; then
+        err="ends with build_distribution, but install_${dist}_with_drush() is not in fun-distribution-${dist}.sh"
+      fi
+    fi
+
     # 4. Builder scripts must have the human-readable name header.
     #    A builder is cmd-<distribution><version>-project.sh. cmd-tool-*/cmd-tools-* are the
     #    workspace's own tools — projects/cmd-tool-backup-project.sh ends in -project.sh too,

package/core/workspace-app/docs/README.md

@@ -247,6 +247,7 @@ Some releases change the container image; the notes say so, and then
 | the hard rules and the operational traps | `docs/workspace-tips-and-rules.md` |
 | what changed, dated | `worklogs/` |
 
-Every picture in `screenshots/` is used by one of these guides or the top `README.md`, and all of them
-were taken on 22 October 2026 at 1920×1080, in light mode (the README's dark copies aside). A pull
-request carries its own pictures on its branch.
+The pictures in `screenshots/` are used by these guides; `assistant/` and `readme/` hold spare ones of
+the assistant's avatar and of the pages in light and dark. All of them were taken on 13 November 2026
+on a Webship Workspace with demo content, at 1920×1080 (the home page is taller, to show every card),
+in light mode unless the name says dark. A pull request carries its own pictures on its branch.

package/core/workspace-app/docs/USER-GUIDE.md

@@ -399,7 +399,7 @@ Claude ends the way it would if you typed it, and the conversation is kept. When
 project or folder that has one, the same menu offers **Resume Claude Code**, which resumes the last conversation
 with `claude --resume` in that folder.
 
-![The SCREENS menu on a card: its sessions, Resume Claude Code, New screen here and Claude Code here](screenshots/screens-menu.png)
+![The SCREENS menu on a card: its session, New screen here, Claude Code here and All screens](screenshots/screens-menu.png)
 
 ### Watch something long
 
@@ -459,7 +459,7 @@ Pick the **Provider** first: OpenAI, Google Gemini, xAI, Stability AI or Claude
 quality fields change with it. A provider with no key on this machine is listed but greyed out, with the key
 to set (`ai_providers.<provider>.api_key` in `core/config/settings.yml`).
 
-![The provider select: the ones without a key say which key to set](screenshots/images/providers.png)
+![Generate with AI: the form, with Claude Code CLI as the provider](screenshots/images/providers.png)
 
 **Claude Code** needs no key: it uses your own Claude Code login, so there is no API charge. It cannot paint
 a photo, so it draws a flat illustration as an SVG, and the dashboard turns it into a PNG as well; you keep

package/core/workspace-app/package.json

@@ -1,6 +1,6 @@
 {
   "name": "workspace-dashboard",
-  "version": "1.0.3",
+  "version": "1.0.5",
   "description": "The Webship Workspace dashboard: a lean core (workspaces, builders, settings, the assistant shell, the plugin system) that every feature joins as a @webship.co/workspace-<name> plugin — required with npm, then activated, installed and configured.",
   "license": "ISC",
   "main": "server.js",

package/core/workspace-app/server.js

@@ -7875,7 +7875,7 @@ Summarise what you changed and how to verify it`,
           // An SVG is a document that can carry script; shown on its own it runs none.
           ...(type === 'image/svg+xml' ? { 'Content-Security-Policy': "default-src 'none'; style-src 'unsafe-inline'; sandbox" } : {}),
         });
-        return fs.createReadStream(file).pipe(res);
+        return fs.createReadStream(real).pipe(res);
       }
       const argsMatch = pathname.match(/^\/fragments\/([a-z0-9_-]+)\/builder-args$/);
       if (argsMatch && isValidWorkspace(argsMatch[1])) {

package/core/workspace-app/tests/unit/build-distribution.test.js

@@ -59,6 +59,50 @@ test('every ddev config of a build pins Node.js 24, and the first one still gets
   assert.ok(!configs[0].includes('ddev_telemetry_off'), configs[0]);
 });
 
+test('the PHP version of the build is set again after create-project, where the template brings its own DDEV config', () => {
+  // The template's .ddev/config.yaml replaces the builder's: composer resolved on 8.4, the project ran the
+  // template's 8.3, and drush site:install stopped on "Your Composer dependencies require a PHP version".
+  for (const declare of ['PHP_VERSION=8.4', 'site_php_version=8.4', 'PHP_VERSION=8.4; site_php_version=8.5']) {
+    const { calls, code } = build({ declare });
+    assert.strictEqual(code, 0);
+    const configs = calls.filter((c) => c.startsWith('config '));
+    assert.strictEqual(configs.length, 2, configs.join('\n'));
+    for (const c of configs) assert.ok(c.includes('--php-version=8.4'), `${declare}: ${c}`);
+    assert.ok(index(calls, 'composer create-project') < calls.indexOf(configs[1]), 'the second one follows create-project');
+    assert.ok(configs[1].includes('--database=mariadb:11.8') && configs[1].includes('--nodejs-version=24'), configs[1]);
+  }
+  // Nobody asked for a version: DDEV's default before, the template's own after, as it was.
+  const plain = build();
+  for (const c of plain.calls.filter((x) => x.startsWith('config '))) assert.ok(!c.includes('--php-version'), c);
+});
+
+test('the Webships builder sets its PHP version again after create-project too', () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'ws-webships-'));
+  const log = path.join(dir, 'ddev.log');
+  fs.mkdirSync(path.join(dir, 'ws'));
+  const WEBSHIPS = path.join(path.dirname(FUNCTION), 'fun-build-webships.sh');
+  const run = (declare) => {
+    fs.rmSync(log, { force: true });
+    const script = `
+WORKSPACE_ROOT=${dir}; doc_name=ws; PROJECT_NAME=p1; distribution_webroot=web; ${declare}
+ddev() { printf '%s\\n' "$*" >> ${log}; return 0; }
+drop_database() { :; }
+source ${NODEJS}; source ${WEBSHIPS}
+webships_create_project drupal/stub:1.0.x-dev; echo "exit=$?"
+`;
+    const out = spawnSync('bash', ['-c', script], { cwd: dir, encoding: 'utf8' }).stdout;
+    assert.match(out, /exit=0/);
+    return fs.readFileSync(log, 'utf8').trim().split('\n');
+  };
+  for (const [declare, version] of [['PHP_VERSION=8.5', '8.5'], ['', '8.4']]) {
+    const calls = run(declare);
+    const configs = calls.filter((c) => c.startsWith('config '));
+    assert.strictEqual(configs.length, 2, configs.join('\n'));
+    for (const c of configs) assert.ok(c.includes(`--php-version=${version}`) && c.includes('--nodejs-version=24'), c);
+    assert.ok(index(calls, 'composer create-project') < calls.indexOf(configs[1]));
+  }
+});
+
 test('a builder that declares site_nodejs_version gets that version instead', () => {
   const { calls } = build({ declare: 'site_nodejs_version=22' });
   const configs = calls.filter((c) => c.startsWith('config '));

package/core/workspace-app/tests/unit/build-website.test.js

@@ -0,0 +1,116 @@
+/**
+ * What the Website builders run, in what order.
+ *
+ * ddev and the helpers around it are stubbed, so the test reads the calls rather than building a site.
+ * build_website_project (drupal/website, installed by the Webship installer) had no way to add a root
+ * requirement or to ignore a patch before the first install, the way build_distribution has.
+ */
+
+const assert = require('node:assert');
+const { test } = require('node:test');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { spawnSync } = require('child_process');
+
+const FUNCTIONS = path.join(__dirname, '..', '..', '..', 'scripts', 'functions');
+
+// Runs a Website build function with a fake ddev that records its arguments, one call per line.
+function build({ declare = '', run = 'build_website_project' } = {}) {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'ws-website-'));
+  const log = path.join(dir, 'ddev.log');
+  fs.mkdirSync(path.join(dir, 'ws'));
+  const script = `
+WORKSPACE_ROOT=${dir}; doc_name=ws; PROJECT_NAME=p1
+distribution_name=website; distribution_title=Website; distribution_webroot=web; distribution_project_template=drupal/website; site_version=12.0.x-dev
+account_name=admin; account_pass=pass; account_mail=admin@example.com
+${declare}
+ddev() { printf '%s\\n' "$*" >> ${log}; return 0; }
+drop_database() { :; }; set_default_settings() { :; }; drush_set_debug_on() { :; }; drush_cr() { :; }; add_users() { :; }
+source ${FUNCTIONS}/fun-build-distribution.sh; source ${FUNCTIONS}/fun-ddev-nodejs.sh; source ${FUNCTIONS}/fun-build-website.sh
+${run}; echo "exit=$?"
+`;
+  const res = spawnSync('bash', ['-c', script], { cwd: dir, encoding: 'utf8' });
+  const calls = fs.existsSync(log) ? fs.readFileSync(log, 'utf8').trim().split('\n') : [];
+  return { calls, out: res.stdout, code: Number((res.stdout.match(/exit=(\d+)/) || [])[1]) };
+}
+
+const index = (calls, needle) => calls.findIndex((c) => c.includes(needle));
+
+test('a Website builder that declares nothing creates the project in one step and installs with the chosen template', () => {
+  const { calls, code } = build({ declare: 'TEMPLATE=webship_portal' });
+  assert.strictEqual(code, 0);
+  const create = calls.find((c) => c.startsWith('composer create-project'));
+  assert.strictEqual(create, 'composer create-project drupal/website:12.0.x-dev . --no-interaction');
+  assert.ok(index(calls, 'patches-ignore') < 0 && index(calls, 'composer install') < 0);
+  const install = calls.find((c) => c.startsWith('drush site:install'));
+  assert.ok(install.includes('site:install webship') && install.includes('installer_site_template_form.add_ons=webship_portal'), install);
+});
+
+test('declared requirements and patches to ignore are applied between create-project and the first install', () => {
+  const { calls, code } = build({
+    declare: `site_composer_requires=("drupal/stub:1.2.3 as 1.2.x-dev"); site_patches_ignore=("drupal/pp https://x.test/a.patch")`,
+  });
+  assert.strictEqual(code, 0);
+  const create = index(calls, 'composer create-project');
+  assert.ok(calls[create].includes('--no-install') && calls[create].includes('--no-scripts'), calls[create]);
+  const order = ['composer create-project', 'composer require drupal/stub', 'composer config --json extra.patches-ignore', 'composer install', 'composer run-script post-create-project-cmd', 'drush site:install']
+    .map((n) => index(calls, n));
+  assert.ok(order.every((i) => i >= 0), calls.join(' | '));
+  assert.deepStrictEqual(order, [...order].sort((a, b) => a - b), `in order: ${calls.join(' | ')}`);
+  assert.strictEqual(calls[order[2]], 'composer config --json extra.patches-ignore {"webship/patches": {"drupal/pp": ["https://x.test/a.patch"]}}');
+});
+
+test('a site template build on the recommended project takes the same declarations', () => {
+  const { calls, code } = build({
+    declare: `site_template_name=website_starter; site_template_title="Website Starter"; site_template_package=drupal/website_starter; site_version=1.0.x-dev; site_patches_ignore=("drupal/pp https://x.test/a.patch")`,
+    run: 'build_website_site_template',
+  });
+  assert.strictEqual(code, 0);
+  const create = calls.find((c) => c.startsWith('composer create-project'));
+  assert.ok(create.startsWith('composer create-project drupal/recommended-project:') && create.includes('--no-install'), create);
+  assert.ok(index(calls, 'extra.patches-ignore') > 0);
+});
+
+test('the Node.js and PHP of the build are set again after create-project, where the template brings its own DDEV config', () => {
+  const { calls, code } = build({ declare: 'PHP_VERSION=8.5' });
+  assert.strictEqual(code, 0);
+  const create = index(calls, 'composer create-project');
+  const configs = calls.map((c, i) => [c, i]).filter(([c]) => c.startsWith('config '));
+  assert.strictEqual(configs.length, 2, configs.map(([c]) => c).join('\n'));
+  assert.ok(configs[0][1] < create && configs[1][1] > create, 'one before create-project, one after');
+  for (const [c] of configs) assert.ok(c.includes('--nodejs-version=24') && c.includes('--php-version=8.5'), c);
+  assert.ok(index(calls, 'restart') > configs[1][1], 'and the project restarts on them');
+  assert.ok(index(calls, 'restart') < index(calls, 'drush site:install'));
+
+  const declared = build({ declare: 'site_nodejs_version=22' });
+  for (const c of declared.calls.filter((x) => x.startsWith('config '))) assert.ok(c.includes('--nodejs-version=22') && c.includes('--php-version=8.4'), c);
+});
+
+test('the Website project keeps the recipe-unpack ignore list its template ships, and a site template build sets one before the lock file', () => {
+  const project = build();
+  assert.strictEqual(project.code, 0);
+  assert.ok(index(project.calls, 'drupal-recipe-unpack') < 0, 'composer.json is not changed after the lock file was written');
+
+  const { calls, code } = build({
+    declare: 'site_template_name=website_starter; site_template_title="Website Starter"; site_template_package=drupal/website_starter; site_version=1.0.x-dev',
+    run: 'build_website_site_template',
+  });
+  assert.strictEqual(code, 0);
+  const ignore = index(calls, 'drupal-recipe-unpack');
+  assert.ok(ignore > 0 && calls[ignore].includes('"drupal/website_starter"'), calls[ignore]);
+  assert.ok(ignore < index(calls, 'composer require -W'), 'before the require that writes the lock file');
+});
+
+test('--template offers the five site templates the Website project ships, and each one reaches the installer', () => {
+  const args = fs.readFileSync(path.join(FUNCTIONS, '..', 'args', 'arg-website.sh'), 'utf8');
+  const choices = args.match(/'--template',[\s\S]*?choices=\[([^\]]*)\]/)[1].split(',').map((c) => c.trim().replace(/'/g, ''));
+  assert.deepStrictEqual(choices, ['website_starter', 'webship_starter', 'webship_portal', 'webapi_starter', 'webships_starter']);
+  for (const template of choices) {
+    const { calls, code } = build({ declare: `TEMPLATE=${template}` });
+    assert.strictEqual(code, 0);
+    assert.ok(calls.find((c) => c.startsWith('drush site:install')).includes(`installer_site_template_form.add_ons=${template}`), template);
+    // No composer.json in the stub project: the builder adds what the template does not require, all five.
+    assert.ok(calls.find((c) => c.startsWith('composer require')).includes(`drupal/${template}:`), template);
+  }
+});

package/core/workspace-app/tests/unit/distribution-users.test.js

@@ -0,0 +1,109 @@
+/**
+ * The default accounts of every distribution (`--add-users`, cmd-tools-add-users.sh) can be created.
+ *
+ * Each list is read from set_<distribution>_users in fun-distribution-<distribution>.sh by bash itself.
+ * The Website and Webship lists had a "Webmaster" account: the installer's own account is `webmaster`,
+ * user names are case-insensitive, so `drush user:create` answered "There is already a user account
+ * with the name Webmaster" and the account never existed.
+ */
+
+const assert = require('node:assert');
+const { test } = require('node:test');
+const fs = require('fs');
+const path = require('path');
+const { spawnSync } = require('child_process');
+
+const SCRIPTS = path.join(__dirname, '..', '..', '..', 'scripts');
+const FUNCTIONS = path.join(SCRIPTS, 'functions');
+const SETTINGS = path.join(SCRIPTS, '..', 'config', 'settings.template.yml');
+
+/** The accounts of one distribution: [{ key, name, mail, password, role }]. */
+function usersOf(distribution) {
+  const script = `
+ddev() { :; }
+source ${FUNCTIONS}/fun-distribution-${distribution}.sh
+set_${distribution}_users
+for user in "\${users[@]}"; do
+  n="user_\${user}_name"; m="user_\${user}_mail"; p="user_\${user}_password"; r="user_\${user}_role"
+  printf '%s|%s|%s|%s|%s\\n' "\${user}" "\${!n}" "\${!m}" "\${!p}" "\${!r}"
+done`;
+  const run = spawnSync('bash', ['-c', script], { encoding: 'utf8' });
+  return run.stdout.trim().split('\n').filter(Boolean).map((line) => {
+    const [key, name, mail, password, role] = line.split('|');
+    return { key, name, mail, password, role };
+  });
+}
+
+const distributions = fs.readdirSync(FUNCTIONS)
+  .map((f) => (f.match(/^fun-distribution-([a-z0-9_]+)\.sh$/) || [])[1])
+  .filter((d) => d && fs.readFileSync(path.join(FUNCTIONS, `fun-distribution-${d}.sh`), 'utf8').includes(`set_${d}_users()`));
+
+// The account the installer creates: account.name in settings.yml.
+const installer = (fs.readFileSync(SETTINGS, 'utf8').match(/^account:\n(?:[ \t]+.*\n)*?[ \t]+name:[ \t]*(\S+)/m) || [])[1];
+
+test('the installer account and the distributions with a user list are found', () => {
+  assert.strictEqual(installer, 'webmaster');
+  for (const d of ['drupal', 'drupal_cms', 'webship', 'website', 'webships', 'cucumber']) assert.ok(distributions.includes(d), d);
+});
+
+for (const distribution of distributions) {
+  test(`${distribution}: every default account is complete, and no name is taken`, () => {
+    const users = usersOf(distribution);
+    assert.ok(users.length > 0, 'the list is not empty');
+    for (const u of users) {
+      assert.ok(u.name && u.mail && u.password && u.role, `${u.key} misses a value: ${JSON.stringify(u)}`);
+      assert.notStrictEqual(u.name.toLowerCase(), installer.toLowerCase(), `"${u.name}" is the installer's account: user names are case-insensitive`);
+    }
+    const names = users.map((u) => u.name.toLowerCase());
+    assert.strictEqual(new Set(names).size, names.length, `two accounts share a name: ${names.join(', ')}`);
+    const mails = users.map((u) => u.mail.toLowerCase());
+    assert.strictEqual(new Set(mails).size, mails.length, `two accounts share a mail: ${mails.join(', ')}`);
+  });
+}
+
+/** The ddev calls of add_users for one distribution, with ddev stubbed. */
+function addUsers(distribution, { enableFails = false } = {}) {
+  const os = require('os');
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'ws-users-'));
+  const log = path.join(dir, 'ddev.log');
+  fs.mkdirSync(path.join(dir, 'ws', 'p1', 'web'), { recursive: true });
+  const script = `
+WORKSPACE_SCRIPTS=${SCRIPTS}; WORKSPACE_ROOT=${dir}; doc_name=ws; PROJECT_NAME=p1; distribution_name=${distribution}; distribution_webroot=web
+ddev() { printf '%s\\n' "$*" >> ${log}; if [ "${enableFails ? 'yes' : 'no'}" = yes ] && [ "$1 $2" = 'drush pm:enable' ]; then return 1; fi; return 0; }
+source ${FUNCTIONS}/fun-users.sh
+add_drush() { :; }
+add_users p1 ${distribution} > /dev/null; echo "exit=$?"
+`;
+  const run = spawnSync('bash', ['-c', script], { encoding: 'utf8' });
+  const calls = fs.existsSync(log) ? fs.readFileSync(log, 'utf8').trim().split('\n') : [];
+  return { calls, code: Number((run.stdout.match(/exit=(\d+)/) || [])[1]) };
+}
+
+test('cucumber: the role modules are enabled before the first account, and every role given exists then', () => {
+  const { calls, code } = addUsers('cucumber');
+  assert.strictEqual(code, 0);
+  const enable = calls.findIndex((c) => c.startsWith('drush pm:enable'));
+  const firstUser = calls.findIndex((c) => c.startsWith('drush user:create'));
+  assert.ok(enable >= 0 && enable < firstUser, calls.join(' | '));
+  // The roles of the profile itself, and the ones the enabled role modules bring.
+  const roles = new Set(['admin', 'super_admin', ...[...calls[enable].matchAll(/cucumber_user_role_([a-z_]+)/g)].map((m) => m[1])]);
+  const given = calls.filter((c) => c.startsWith('drush user:role:add')).map((c) => c.split(' ')[2]);
+  assert.deepStrictEqual(given, ['developer', 'tester', 'analyst', 'designer', 'coordinator', 'product_owner', 'admin']);
+  for (const role of given) assert.ok(roles.has(role), `nothing provides the "${role}" role`);
+  assert.ok(!given.includes('administrator'), 'Cucumber has no administrator role');
+  assert.strictEqual(calls.filter((c) => c.startsWith('drush user:create')).length, 8);
+});
+
+test('cucumber: when the role modules cannot be enabled no account is created', () => {
+  const { calls, code } = addUsers('cucumber', { enableFails: true });
+  assert.strictEqual(code, 1);
+  assert.ok(!calls.some((c) => c.startsWith('drush user:create')), calls.join(' | '));
+});
+
+test('a distribution with nothing to prepare adds its users as before', () => {
+  const { calls, code } = addUsers('website');
+  assert.strictEqual(code, 0);
+  assert.ok(!calls.some((c) => c.includes('pm:enable')));
+  assert.deepStrictEqual(calls.filter((c) => c.startsWith('drush user:create')).map((c) => c.split(' --mail')[0]),
+    ['drush user:create Authenticated user', 'drush user:create Content editor', 'drush user:create Administrator']);
+});

package/core/workspace-app/tests/unit/files-route-stream.test.js

@@ -0,0 +1,16 @@
+// The /files/<workspace>/<path> route resolves the file to `real` and must stream that. It streamed
+// `file`, a name the route never defines, so every plain (non-range) request sent headers and no body.
+const assert = require('node:assert');
+const { test } = require('node:test');
+const fs = require('fs');
+const path = require('path');
+
+test('the files route streams the file it resolved', () => {
+  const src = fs.readFileSync(path.join(__dirname, '..', '..', 'server.js'), 'utf8');
+  const start = src.indexOf('filesBrowser.realFileIn(workspaceDir(fileMatch[1]), name)');
+  assert.ok(start > 0, 'the files route was not found');
+  const route = src.slice(start, src.indexOf('builder-args', start));
+  const streams = [...route.matchAll(/fs\.createReadStream\((\w+)/g)].map((m) => m[1]);
+  assert.ok(streams.length >= 2, 'expected the range branch and the whole-file branch');
+  for (const name of streams) assert.strictEqual(name, 'real', `the route streams "${name}", which it does not define`);
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webship.co/workspace",
-  "version": "1.0.3",
+  "version": "1.0.5",
   "description": "Webship Workspace: a container-based development workspace with a web dashboard. The core ships empty; workspace folders, hosting providers, git forges, container runtimes and features are @webship.co/workspace-<name> plugins you add one at a time.",
   "license": "GPL-2.0-or-later",
   "repository": {