splent-cli 1.40.0__tar.gz → 1.42.0__tar.gz

{splent_cli-1.40.0/src/splent_cli.egg-info → splent_cli-1.42.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: splent_cli
-Version: 1.40.0
+Version: 1.42.0
 Summary: SPLENT-CLI is a CLI to be able to work on your development more easily.
 Author-email: DiversoLab <diversolab@us.es>
 License-Expression: LGPL-3.0-or-later

{splent_cli-1.40.0 → splent_cli-1.42.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "splent_cli"
-version = "1.40.0"
+version = "1.42.0"
 description = "SPLENT-CLI is a CLI to be able to work on your development more easily."
 readme = "README.md"
 requires-python = ">=3.13"

{splent_cli-1.40.0 → splent_cli-1.42.0}/src/splent_cli/cli.py

@@ -1,3 +1,4 @@
+import contextlib
 import logging
 import os
 
@@ -20,6 +21,27 @@ def _missing_module(exc: BaseException) -> str | None:
     return None
 
 
+@contextlib.contextmanager
+def _quiet_unless(debug: bool):
+    """The framework's logging muted while the app is built for discovery.
+
+    Discovery runs before every command, including the ones a product that
+    is not built yet (selected, not configured or derived) runs while
+    getting there. Building its app then fails, and the framework logged
+    that failure with a full traceback on every single command, although
+    nothing was wrong. The failure is expected there and handled, so the
+    framework's logging is muted for the attempt.
+    """
+    if debug:
+        yield
+        return
+    logging.disable(logging.CRITICAL)
+    try:
+        yield
+    finally:
+        logging.disable(logging.NOTSET)
+
+
 class SPLENTCLI(click.Group):
     """
     Main SPLENT CLI class.
@@ -27,6 +49,7 @@ class SPLENTCLI(click.Group):
     - Automatically injects the Flask app context for commands marked with `requires_app = True`.
     - Checks DB connectivity for commands marked with `requires_db = True`.
     - Discovers CLI commands contributed by features via ``app.extensions["splent_feature_commands"]``.
+    - Discovers the product's own commands, ``product:<name>`` (services/own_commands.py).
     - Displays commands grouped by category for a cleaner, more readable help output.
     """
 
@@ -49,44 +72,65 @@ class SPLENTCLI(click.Group):
             return self._feature_cmds_cache
 
         self._feature_cmds_cache: dict[str, click.BaseCommand] = {}
-        # Discovery runs before every command, including the ones a product
-        # that is not built yet (selected, not configured or derived) runs
-        # while getting there. Building its app then fails, and the framework
-        # logged that failure with a full traceback on every single command,
-        # although nothing was wrong. The failure is expected here and
-        # handled below, so the framework's logging is muted for the attempt.
         debug = bool(os.getenv("SPLENT_DEBUG"))
-        if not debug:
-            logging.disable(logging.CRITICAL)
         try:
-            from splent_cli.utils.dynamic_imports import get_app
+            with _quiet_unless(debug):
+                from splent_cli.utils.dynamic_imports import get_app
 
-            app = get_app()
-            with app.app_context():
-                registry = app.extensions.get("splent_feature_commands", {})
-                for feature_short, commands in registry.items():
-                    cmd_names = ", ".join(c.name for c in commands if c.name)
-                    group = click.Group(
-                        name=f"feature:{feature_short}",
-                        help=f"Commands contributed by splent_feature_{feature_short}.",
-                        short_help=f"Subcommands: {cmd_names}"
-                        if cmd_names
-                        else f"Commands from splent_feature_{feature_short}.",
-                    )
-                    group.requires_app = True  # type: ignore[attr-defined]
-                    for cmd in commands:
-                        group.add_command(cmd)
-                    self._feature_cmds_cache[group.name] = group
+                app = get_app()
+                with app.app_context():
+                    registry = app.extensions.get("splent_feature_commands", {})
+                    for feature_short, commands in registry.items():
+                        cmd_names = ", ".join(c.name for c in commands if c.name)
+                        group = click.Group(
+                            name=f"feature:{feature_short}",
+                            help=f"Commands contributed by splent_feature_{feature_short}.",
+                            short_help=f"Subcommands: {cmd_names}"
+                            if cmd_names
+                            else f"Commands from splent_feature_{feature_short}.",
+                        )
+                        group.requires_app = True  # type: ignore[attr-defined]
+                        for cmd in commands:
+                            group.add_command(cmd)
+                        self._feature_cmds_cache[group.name] = group
         except Exception as e:
             if debug:
                 click.secho(
                     f"  ⚠ Feature commands not loaded: {e}", fg="yellow", err=True
                 )
-        finally:
-            if not debug:
-                logging.disable(logging.NOTSET)
         return self._feature_cmds_cache
 
+    def load_own_commands(self):
+        """The product's own commands, ``product:<name>``, as an
+        :class:`~splent_cli.services.own_commands.OwnCommands`.
+
+        Found like a feature's: once the product's app is built, which
+        fails quietly here for a product that cannot be built yet. The
+        CLI's own product:* commands win over a product's.
+        """
+        if hasattr(self, "_own_cmds_cache"):
+            return self._own_cmds_cache
+
+        from splent_cli.services import own_commands
+
+        self._own_cmds_cache = own_commands.NONE
+        debug = bool(os.getenv("SPLENT_DEBUG"))
+        try:
+            with _quiet_unless(debug):
+                from splent_cli.utils.dynamic_imports import get_app
+
+                app = get_app()
+                with app.app_context():
+                    self._own_cmds_cache = own_commands.collect(
+                        os.getenv("SPLENT_APP"), set(self.commands)
+                    )
+        except Exception as e:
+            if debug:
+                click.secho(
+                    f"  ⚠ Product commands not loaded: {e}", fg="yellow", err=True
+                )
+        return self._own_cmds_cache
+
     def get_command(self, ctx, cmd_name):
         # "feature:<short>" belongs to the feature called <short> whenever the
         # product installs one. Built-ins win everywhere else.
@@ -100,13 +144,19 @@ class SPLENTCLI(click.Group):
         feat_cmds = self._load_feature_commands()
         if cmd_name in feat_cmds:
             return feat_cmds[cmd_name]
-        return super().get_command(ctx, cmd_name)
+        command = super().get_command(ctx, cmd_name)
+        # "product:<name>" is the product's only where the CLI has no
+        # command of that name, so asking for a built-in never imports it.
+        if command is None and cmd_name and cmd_name.startswith("product:"):
+            command = self.load_own_commands().commands.get(cmd_name)
+        return command
 
     def list_commands(self, ctx):
         builtin = super().list_commands(ctx)
         feat = sorted(self._load_feature_commands().keys())
+        own = sorted(self.load_own_commands().commands)
         # A name a feature claimed is listed once, as the feature's.
-        return [name for name in builtin if name not in feat] + feat
+        return [name for name in builtin if name not in feat] + feat + own
 
     # ── App context injection ─────────────────────────────────────
 
@@ -132,9 +182,14 @@ class SPLENTCLI(click.Group):
         cmd_name = ctx.protected_args[0] if ctx.protected_args else None
         command = self.get_command(ctx, cmd_name)
 
-        # A feature's own commands are only found by building the app, so
-        # here they may be missing although the product has them.
-        if command is None and cmd_name and cmd_name.startswith("feature:"):
+        # A feature's commands, and the product's own, are only found by
+        # building the app, so here they may be missing although the
+        # product has them.
+        if (
+            command is None
+            and cmd_name
+            and cmd_name.startswith(("feature:", "product:"))
+        ):
             self._delegate_to_the_product(ctx)
 
         if command and getattr(command, "requires_app", False):
@@ -169,6 +224,7 @@ class SPLENTCLI(click.Group):
         """Group SPLENT commands by category in the CLI help output."""
         all_cmds = self.list_commands(ctx)
         feat_cmds = self._load_feature_commands()
+        own_cmds = self.load_own_commands().commands
         groups = {
             "🌿 Feature Management": [
                 cmd
@@ -176,7 +232,9 @@ class SPLENTCLI(click.Group):
                 if cmd.startswith("feature:") and cmd not in feat_cmds
             ],
             "🏗️ Product Management": [
-                cmd for cmd in all_cmds if cmd.startswith("product:")
+                cmd
+                for cmd in all_cmds
+                if cmd.startswith("product:") and cmd not in own_cmds
             ],
             "🧬 SPL & Variability": [
                 cmd for cmd in all_cmds if cmd.startswith(("spl:", "uvl:"))
@@ -207,6 +265,7 @@ class SPLENTCLI(click.Group):
                 if cmd in ("lint", "coverage", "selenium", "locust", "locust:stop")
             ],
             "🔌 Feature Commands": [cmd for cmd in all_cmds if cmd in feat_cmds],
+            "🔌 Product Commands": [cmd for cmd in all_cmds if cmd in own_cmds],
         }
         total = 0
         for title, cmds in groups.items():

{splent_cli-1.40.0 → splent_cli-1.42.0}/src/splent_cli/commands/database/db_status.py

@@ -58,9 +58,22 @@ def _get_filesystem_head(mdir: str) -> str | None:
     "db:status",
     short_help="Show migration status for all features.",
 )
+@click.option(
+    "--check",
+    is_flag=True,
+    help="Exit 1 when a feature's schema is not at the head of its migrations "
+    "(pending, not applied, or applied from scripts that are gone).",
+)
 @context.requires_product
-def db_status():
-    """Show migration status: DB revision vs filesystem head for each feature."""
+def db_status(check):
+    """Show migration status: DB revision vs filesystem head for each feature.
+
+    \b
+    --check is for a start that must not serve on a schema older than its
+    code: the product's entrypoint runs it with SPLENT_MIGRATE_ON_START=check,
+    when a deploy agent migrates in a step of its own. An orphan (a feature
+    no longer declared) does not count.
+    """
     app = current_app
 
     click.echo(click.style("\n📊 Migration Status\n", fg="cyan", bold=True))
@@ -151,7 +164,7 @@ def db_status():
     if issues:
         click.secho(
             f"  {issues} feature(s) out of sync. Run 'splent db:upgrade' to apply pending migrations.",
-            fg="yellow",
+            fg="red" if check else "yellow",
         )
         click.echo()
     if orphans:
@@ -164,6 +177,8 @@ def db_status():
             fg="red",
         )
         click.echo()
+    if check and issues:
+        raise SystemExit(1)
 
 
 cli_command = db_status

{splent_cli-1.40.0 → splent_cli-1.42.0}/src/splent_cli/commands/feature/feature_create.py

@@ -276,7 +276,8 @@ def _build_file_map(feature_type, short_name, docker=False, js=False):
         src = {
             "__init__.py": f"{T}feature_init_service.py.j2",
             "config.py": f"{T}feature_config.py.j2",
-            "services.py": f"{T}feature_services.py.j2",
+            # No models, so no repository for the service to wrap.
+            "services.py": f"{T}feature_services_service.py.j2",
             "signals.py": f"{T}feature_signals.py.j2",
             "commands.py": f"{T}feature_commands.py.j2",
         }

{splent_cli-1.40.0 → splent_cli-1.42.0}/src/splent_cli/commands/feature/feature_test.py

@@ -46,12 +46,15 @@ def _tied_to_the_cli(command: str, lock: str = TEST_LOCK) -> str:
     The CLI holds the exec's stdin open while it runs (see
     _delegate_to_web_container). When the CLI goes, stdin closes, and the
     watcher stops the whole run. A run that finds another one holding the
-    lock waits for it instead of running beside it.
+    lock waits for it instead of running beside it. The lock is opened for
+    reading, which flock needs no more than: a run as the workspace's user
+    shares the file a run as root created.
     """
     return f"""set -m
 exec 3<&0
 if command -v flock >/dev/null 2>&1; then
-  exec 9>{lock}
+  [ -e {lock} ] || : > {lock}
+  exec 9<{lock}
   if ! flock -n 9; then
     echo "  Another test run is using this product's test database. Waiting for it to finish..."
     flock 9
@@ -84,13 +87,79 @@ def _delegate_to_web_container(argv: list[str]) -> None:
     )
 
 
-def run_tests_in_web_container(product: str, argv: list[str]) -> int:
+def workspace_user(container: str) -> list[str]:
+    """The docker exec options that run a command in CONTAINER as the user
+    who owns the workspace.
+
+    An exec runs as the image's user, root in a development image, and a
+    test run writes into the working copies: bytecode, .pytest_cache, what
+    the tests leave. As root they stayed root's, and the next release of
+    the feature could not rewrite them. The owner is read from the
+    workspace's files, whoever this process runs as. A development image
+    has no account for that uid as a rule; Docker runs a bare uid all the
+    same, and the exec then names it in USER and LOGNAME, which
+    getpass.getuser() reads before the account it does not find (pymysql
+    asks it), with HOME a directory of its own under /tmp. A workspace root
+    owns stays root's, and so does a container where the account cannot be
+    looked up.
+    """
+    owner = _workspace_owner()
+    if owner is None or owner[0] == 0:
+        return []
+    uid, gid = owner
+    found = run(
+        ["docker", "exec", container, "getent", "passwd", str(uid)],
+        check=False,
+        capture=True,
+    )
+    if found.returncode not in (0, 2):
+        # 2 is getent's "no such entry"; anything else is a container that
+        # cannot answer, where the exec keeps the image's user.
+        return []
+    options = ["-u", f"{uid}:{gid}"]
+    fields = (found.stdout or "").strip().split(":")
+    if found.returncode != 0 or len(fields) < 6 or not fields[5]:
+        user = _account_name(uid)
+        options += [
+            "-e",
+            f"HOME=/tmp/splent-home-{uid}",
+            "-e",
+            f"USER={user}",
+            "-e",
+            f"LOGNAME={user}",
+        ]
+    return options
+
+
+def _account_name(uid: int) -> str:
+    """The name this machine gives UID, ``splent`` when it gives none."""
+    import pwd
+
+    try:
+        return pwd.getpwuid(uid).pw_name
+    except KeyError:
+        return "splent"
+
+
+def _workspace_owner() -> tuple[int, int] | None:
+    """``(uid, gid)`` of the workspace's root directory, or None."""
+    try:
+        owner = context.workspace().stat()
+    except OSError:
+        return None
+    return owner.st_uid, owner.st_gid
+
+
+def run_tests_in_web_container(product: str, argv: list[str], env=()) -> int:
     """Run ``splent <argv>`` in PRODUCT's web container, as a test run.
 
     Returns its exit code, or 1 when the container is not running. The run
     waits for any other test run in that container and stops when this
-    process does (see :func:`_tied_to_the_cli`). feature:test runs there
-    this way, and so do the product's own tests (product:test).
+    process does (see :func:`_tied_to_the_cli`), and runs as the workspace's
+    owner (:func:`workspace_user`). feature:test runs there this way, and so
+    do the product's own tests (product:test) and the release gate, which
+    runs feature:test. ``env`` names more variables of this process's
+    environment for the run (product:test's [tool.splent.test] env).
     """
     name = web_container.name(product)
     if not _container_running(name):
@@ -112,6 +181,11 @@ def run_tests_in_web_container(product: str, argv: list[str]) -> int:
         value = os.environ.get(var)
         if value:
             passthrough += ["-e", f"{var}={value}"]
+    # By name alone: docker reads each value from this process's
+    # environment, so a password never shows in the exec's arguments.
+    for var in env:
+        if var in os.environ:
+            passthrough += ["-e", var]
     # The exec reads a pipe only this process writes to, so it sees the end
     # of its input exactly when this process ends, however it ends.
     read_end, write_end = os.pipe()
@@ -121,6 +195,7 @@ def run_tests_in_web_container(product: str, argv: list[str]) -> int:
                 "docker",
                 "exec",
                 "-i",
+                *workspace_user(name),
                 "-e",
                 f"SPLENT_APP={product}",
                 *passthrough,
@@ -694,15 +769,19 @@ def _run_neutral(
     problem = neutral_app.database_problem(dict(os.environ))
     if problem:
         _neutral_refusal(problem)
-    missing = neutral_app.missing_distributions(members)
-    if missing:
-        product = context.require_app()
+    product = context.require_app()
+    unmet = neutral_app.unmet_requirements(members)
+    from_workspace = [str(u) for u in unmet if not u.installable]
+    if from_workspace:
+        # The framework, the CLI and the features are the workspace's
+        # copies, which a run never replaces with a release.
         _neutral_refusal(
-            f"The neutral app needs packages that {product}'s image does not\n"
-            "   have at the version asked for:\n"
-            + "\n".join(f"     {line}" for line in missing)
-            + "\n   Install them in the container, or run the tests in a product\n"
-            "   that declares the feature."
+            f"The neutral app needs SPLENT packages that {product}'s container\n"
+            "   does not have at the version asked for:\n"
+            + "\n".join(f"     {line}" for line in from_workspace)
+            + "\n   The container has the workspace's copies of them. Update the\n"
+            "   working copy, or run the tests in a product that declares the\n"
+            "   feature."
         )
 
     test_paths = _collect_test_paths([(feature.name, feature.root)])
@@ -710,15 +789,33 @@ def _run_neutral(
         click.secho("⚠️  No test directories found.", fg="yellow")
         return
 
-    click.secho(
-        f"\n🧪 Running tests for {feature_ref} in a neutral app "
-        f"[{', '.join(levels)}]...",
-        fg="cyan",
-    )
     with tempfile.TemporaryDirectory(prefix="splent-neutral-") as tmp:
+        venv_dir = None
+        if unmet:
+            click.echo(
+                f"  {product}'s image lacks what these need, so the run installs "
+                "it in a\n  virtual environment of its own, removed after it:"
+            )
+            for line in unmet:
+                click.echo(f"    {line}")
+            try:
+                venv_dir = neutral_app.install_requirements(Path(tmp), unmet)
+            except neutral_app.NeutralAppError as e:
+                _neutral_refusal(
+                    f"{e}\n   Install them in the container, or run the tests "
+                    "in a product\n   that declares the feature."
+                )
+        click.secho(
+            f"\n🧪 Running tests for {feature_ref} in a neutral app "
+            f"[{', '.join(levels)}]...",
+            fg="cyan",
+        )
         neutral_app.write_app(Path(tmp), members)
-        env = neutral_app.environment(Path(tmp), members)
-        _run_pytest(test_paths, levels, keyword, verbose, environment=env)
+        env = neutral_app.environment(Path(tmp), members, venv_dir=venv_dir)
+        python = str(venv_dir / "bin" / "python") if venv_dir else None
+        _run_pytest(
+            test_paths, levels, keyword, verbose, environment=env, python=python
+        )
 
 
 def _resolve_levels(unit, integration, functional, e2e, load) -> tuple[str, ...]:
@@ -744,12 +841,15 @@ def _run_pytest(
     verbose: bool,
     extra_sources: list[tuple[str, Path]] = (),
     environment: dict | None = None,
+    python: str | None = None,
 ):
     """Run each feature's tests, level by level, and exit 1 if any failed.
 
     ENVIRONMENT, when given, is the whole environment of every run (the
     neutral app's). Otherwise each run gets this process's, with the import
-    path and the feature sources of the active product.
+    path and the feature sources of the active product. PYTHON, when given,
+    is the interpreter that runs pytest (the neutral app's virtual
+    environment).
     """
     passed = failed = skipped = 0
     for pkg, test_dir, src_dir in test_paths:
@@ -790,7 +890,7 @@ def _run_pytest(
                 )
 
             cmd = [
-                "pytest",
+                *([python, "-m", "pytest"] if python else ["pytest"]),
                 str(level_dir),
                 "--rootdir=.",
                 "-W",

{splent_cli-1.40.0 → splent_cli-1.42.0}/src/splent_cli/commands/product/product_auto_require.py

@@ -15,6 +15,8 @@ from splent_cli.commands.uvl.uvl_utils import (
     list_all_features_from_uvl as _list_all_features_from_uvl,
     extract_implications_from_uvl_text as _extract_implications_from_uvl_text,
     print_uvl_header as _print_uvl_header,
+    parameter_nodes_of as _parameter_nodes_of,
+    parameters_to_set as _parameters_to_set,
 )
 from splent_cli.utils.ci_workflow import keeps_ci_workflows
 
@@ -172,10 +174,17 @@ def product_complete(pyproject, default_org, yes, dry_run):
 
     # current selection from pyproject: the one product:validate checks, the
     # base list plus the list of the current environment (dev when unset)
-    deps = read_features_from_data(data, context.resolve_env())
+    env = context.resolve_env()
+    deps = read_features_from_data(data, env)
     selected_names = {_normalize_feature_name(d) for d in deps}
     selected_names.add(root_name)  # root always selected
 
+    # The nodes the product's values select count as selected (P7), and a
+    # parameter node a constraint asks for is a value to set in
+    # [tool.splent.config]: it has no package, and is never added.
+    nodes, chosen = _parameter_nodes_of(workspace, data, local_uvl, selected_names, env)
+    selected_names |= set(chosen)
+
     # compute missing via implications
     pairs = _extract_implications_from_uvl_text(uvl_text)
     req_graph = _build_req_graph(pairs)
@@ -185,6 +194,18 @@ def product_complete(pyproject, default_org, yes, dry_run):
 
     # filter out root just in case
     missing_names = [f for f in missing_names if f != root_name]
+    missing_values = [f for f in missing_names if f in nodes]
+    missing_names = [f for f in missing_names if f not in nodes]
+
+    def say_values():
+        if missing_values:
+            to_set = _parameters_to_set(missing_values, nodes, workspace, data, env)
+            click.secho(
+                "Not added, values to set in [tool.splent.config]: "
+                + ", ".join(to_set),
+                fg="yellow",
+            )
+            click.echo()
 
     # sanity
     unknown_missing = sorted([f for f in missing_names if f not in universe_set])
@@ -195,6 +216,7 @@ def product_complete(pyproject, default_org, yes, dry_run):
 
     if not missing_names:
         _print_uvl_header("complete", app_name, local_uvl, len(universe))
+        say_values()
         click.echo("OK: nothing to add (no missing dependencies).")
         click.echo()
         return
@@ -213,6 +235,7 @@ def product_complete(pyproject, default_org, yes, dry_run):
         to_add_specs.append(spec)
 
     _print_uvl_header("complete", app_name, local_uvl, len(universe))
+    say_values()
     click.echo("Missing features (by name):")
     for f in missing_names:
         click.echo(f"- {f}")

{splent_cli-1.40.0 → splent_cli-1.42.0}/src/splent_cli/commands/product/product_build.py

@@ -824,16 +824,34 @@ def _reset_features_dir(docker_path: str) -> None:
 # with a one-shot service must declare restart: "no", quoted.
 RESTART_POLICY = "unless-stopped"
 
-# The web container's health probe. Python is the one interpreter every
-# production image has, so the probe needs no extra package (curl is not
-# guaranteed). Any answer below 500 counts as healthy: a product without a
-# public home answers 302 or 404 at "/", and that still proves gunicorn and
-# the app are serving. A refused connection, a timeout or a 5xx does not.
+# The web container's health probe, which product:deploy waits on too.
+# Python is the one interpreter every production image has, so the probe
+# needs no extra package (curl is not guaranteed). It asks the framework's
+# /readyz (splent_framework 1.21 and later): 200 when the database and the
+# services the product declares answer, 503 when they do not. The framework
+# answers it before the app's own code runs, so TRUSTED_HOSTS never sees
+# it. "/" did not do: with TRUSTED_HOSTS set it answers 400 to a request
+# for 127.0.0.1, and a broken database could still serve a cached page.
+# Any other answer at /readyz comes from the app's own routes: a framework
+# older than 1.21, or a product that turned the probe off. That app is
+# healthy when "/" answers below 500, the probe it had before.
 WEB_HEALTH_PROBE = (
+    "import http.client as h\n"
+    "def status(path):\n"
+    "    c = h.HTTPConnection('127.0.0.1', 5000, timeout=4)\n"
+    "    c.request('GET', path)\n"
+    "    return c.getresponse().status\n"
+    "ready = status('/readyz')\n"
+    "ok = ready == 200 if ready in (200, 503) else status('/') < 500\n"
+    "raise SystemExit(not ok)\n"
+)
+# The probe CLIs before 1.41 wrote, which product:build replaces with the
+# one above: a product created with them has it in its prod compose file.
+LEGACY_WEB_HEALTH_PROBES = (
     "import http.client as h; "
     "c = h.HTTPConnection('127.0.0.1', 5000, timeout=4); "
     "c.request('GET', '/'); "
-    "raise SystemExit(c.getresponse().status >= 500)"
+    "raise SystemExit(c.getresponse().status >= 500)",
 )
 WEB_HEALTHCHECK = {
     "test": ["CMD", "python3", "-c", WEB_HEALTH_PROBE],
@@ -906,9 +924,11 @@ def local_or_registry_image(product: str) -> str:
 
 def apply_production_policies(compose_data: dict, product: str) -> dict:
     """Give every deployed service a restart policy, and the web and database
-    services a healthcheck, unless the compose file already set one. The web
-    image becomes ``${SPLENT_IMAGE:-<product>:latest}``, so a host can run the
-    image a release published instead of building its own.
+    services a healthcheck, unless the compose file already set one. A web
+    healthcheck that is the probe an older CLI wrote (it asked "/") is
+    brought up to WEB_HEALTH_PROBE. The web image becomes
+    ``${SPLENT_IMAGE:-<product>:latest}``, so a host can run the image a
+    release published instead of building its own.
 
     Applied by product:build to the merged deploy compose, so every product
     gets it on its next build, whatever its docker-compose.prod.yml says and
@@ -924,7 +944,12 @@ def apply_production_policies(compose_data: dict, product: str) -> dict:
         None,
     )
     if web_name and isinstance(services[web_name], dict):
-        services[web_name].setdefault("healthcheck", dict(WEB_HEALTHCHECK))
+        healthcheck = services[web_name].setdefault(
+            "healthcheck", dict(WEB_HEALTHCHECK)
+        )
+        test = healthcheck.get("test") if isinstance(healthcheck, dict) else None
+        if isinstance(test, list) and test and test[-1] in LEGACY_WEB_HEALTH_PROBES:
+            healthcheck["test"] = list(WEB_HEALTHCHECK["test"])
         # The local build, unless deploy/.env names a registry image. Only the
         # plain local name is rewritten: an image the product chose on purpose
         # is left alone.