The app template is a repository: new apps start from trevato/app-template, and scaffold.ts's strings go #11662

This pull needs no merge from me, and I pushed nothing: torque/10305-the-app-template-is-a-repository-new-app on the fork already merges cleanly with main.

An earlier run of mine rebuilt the branch directly on current main (f53271ea7) and pushed it, with the head commit c368bca99 ("Supersede the earlier attempt on this branch…"). My local clone, and the conflict list you were sent, were still on the old history.

I confirmed the fork branch is clean:

• git merge-tree against origin/main reports no conflicts.
• bun x tsc --noEmit is clean.
• test/app-template.test.ts, test/cookie-flags.test.ts and test/security-floor-doors.test.ts pass.

I did not run the full suite. The forge's own check runs it on the push.

I also resolved the merge of old history with main locally. It built a second merge commit, bd3d9c651, which the push rejected as non-fast-forward. I did not force it, since it would only have replaced the rebuilt branch with the same work. I then reset my clone to the fork branch, so no local merge commit remains.

What the branch does on top of main:

• Starter source: a new app that names no template starts from the tip of trevato/app-template. A forge without that repository uses templates/app-template.json, the copy in the image, now including src/once.ts and its test, which main added to the starter.
• scaffold.ts removed: the strings are gone. main's template naming, marking, folder picker and surfaces are kept as they are, and this branch adds no marking of its own.
• Not done: the release build does not yet pin the template repository's commit into the image, so the baked copy and the repository can differ until it does. docs/features/app-template.md says so.

Two test failures I saw in the wider run are not from this change. The guest-contribute test fails because its git push to forge.test is denied by my sandbox's network. A "real home reads as text" test failed once in a broad run and passed when run on its own.

Continues #11662

New app now copies trevato/app-template's tip when the forge has that repository. Otherwise it uses a copy baked into the image. The scaffold strings are deleted, but the baked copy is not yet pinned to a commit of the real repository (below). It is untried on the forge: I ran the touched suites, including the fresh-app and template ones, plus gate, tsc and design-lint, all green. I did not run the whole suite; the forge's check does that on this push.

I rebuilt this on current main instead of resuming the two parked branches. Main already has marking, the picker, the /settings/app-templates page, template: on the API and MCP, and owner/name/folder templates. That left items 2, 3 and 4 plus the strings. The old branch is merged in with -s ours, so none of its content is carried over.

What changed

• Template source. src/apps/template.ts reads the default template's default-branch tip: one commit, no history. apps.template in forge_setting names it, defaulting to trevato/app-template.
• Name and description. template.json lists the files and the two literals, app-template and A new app on the forge.. Only those files change, so the template stays runnable. template.json itself is not copied.
• Image copy. templates/app-template.json is the baked copy, and the Dockerfile ships it. A forge without the repository, or whose template.json is unreadable, falls back to it. template_birth.ts uses the same copy.
• Strings removed. src/apps/scaffold.ts (6,214 lines) is deleted, along with its allow-list entries in the destroy_reach.ts, cookie-flag and security-floor checks. I checked beforehand that the baked copy fills to byte-identical files, with one exception: an empty description now gives package.json the template's default line instead of "".
• Callers and tests. The tests that used scaffoldFiles now boot the baked copy. test/app-template.test.ts covers filling, the tip copy in one commit, the fallback, and that the template's can.ts equals the forge's.
• Birth check. scripts/take-template.ts refreshes the baked copy from a checkout. scripts/birth-check.ts births an app from a checkout and boots it, waiting on /healthz and /.

Not done

• No release pin. templates/app-template.json was generated from the removed strings, so its commit is the forge commit 1428266e, not a commit of the repository. The release build does not yet run take-template.ts at a pinned commit, so the copy and the repository can drift. This is written in docs/features/app-template.md.
• Pull check not wired. The check that runs a template pull's tests and birth-check.ts belongs in trevato/app-template's own forge.json, which my token cannot reach.
• No UI for apps.template. It is only the forge_setting key.
• Two template.json forms. The root template uses {name, description, files}. Main's folder templates use {{name}} literals. I left both rather than change main's contract.

Try it: push a change to trevato/app-template's README, make a new app, and see the change in its first commit.

🤖 Generated with Claude Code

This pull needs no merge from me, and I pushed nothing: torque/10305-the-app-template-is-a-repository-new-app on the fork already merges cleanly with main.

An earlier run of mine rebuilt the branch directly on current main (f53271ea7) and pushed it, with the head commit c368bca99 ("Supersede the earlier attempt on this branch…"). My local clone, and the conflict list you were sent, were still on the old history.

I confirmed the fork branch is clean:

• git merge-tree against origin/main reports no conflicts.
• bun x tsc --noEmit is clean.
• test/app-template.test.ts, test/cookie-flags.test.ts and test/security-floor-doors.test.ts pass.

I did not run the full suite. The forge's own check runs it on the push.

I also resolved the merge of old history with main locally. It built a second merge commit, bd3d9c651, which the push rejected as non-fast-forward. I did not force it, since it would only have replaced the rebuilt branch with the same work. I then reset my clone to the fork branch, so no local merge commit remains.

What the branch does on top of main:

• Starter source: a new app that names no template starts from the tip of trevato/app-template. A forge without that repository uses templates/app-template.json, the copy in the image, now including src/once.ts and its test, which main added to the starter.
• scaffold.ts removed: the strings are gone. main's template naming, marking, folder picker and surfaces are kept as they are, and this branch adds no marking of its own.
• Not done: the release build does not yet pin the template repository's commit into the image, so the baked copy and the repository can differ until it does. docs/features/app-template.md says so.

Two test failures I saw in the wider run are not from this change. The guest-contribute test fails because its git push to forge.test is denied by my sandbox's network. A "real home reads as text" test failed once in a broad run and passed when run on its own.

The one failing check is fixed and pushed. test/timers-named.test.ts passes, 8 of 8, and bun x tsc --noEmit is clean. I did not rerun the host tests. My attempt to run the wake tests timed out and I killed it, so the forge's full check is the verification for those.

Cause: the setTimeout in wakeWhenDue (src/spawn/host.ts) ran its callback outside during(...). The timers test requires every server-side timer callback to be wrapped in during or listed by name in its allowlist. That timer came in with the due-run wake on main (ed63fb6ce), not with the new-app-template work on this branch.

Fix: the callback now runs inside during("spawn-due-wake", …). It does the same work as before: clear its entry, re-arm if it fired early, otherwise call wakeDue and log a warning on failure. I did not add it to the allowlist, because it does real work on the loop.

I did not run scripts/gate.ts or the design lint, since the only file touched is src/spawn/host.ts, not src/web/.

The check failed on one test, and I've fixed it and pushed. It's the job-slices test that makes every job run under during either timed or listed in UNTIMED with a reason. The spawn-due-wake timer added in src/spawn/host.ts was in neither list.

I added it to UNTIMED in test/job-slices.test.ts with the reason that it needs a spawned run and the fixture has none. That test file now passes locally (3 pass, 0 fail) and tsc --noEmit is clean. I did not rerun the full suite; the forge's check will do that on this push.

I did not add a timed case for the wake. It needs a spawned run, which the fixture doesn't have. If you'd rather it be timed, that means building a fixture run first.

Item 1 is still open: templates/app-template.json is not pinned to a real commit of trevato/app-template. My token gets a 404 on that repository, so I couldn't take a checkout, and I did not restore scaffold.ts. The other five items are done, and the touched suites, tsc and the gate pass locally.

What changed

• 1. Pin (not done). A person with a checkout needs to run bun scripts/take-template.ts <checkout> and commit the result.

- The bundle now has an explicit pinned flag, and take-template writes pinned: true with HEAD as commit. - A new test fails if a pinned bundle's commit is not 40 hex characters. - The file in the tree says pinned: false and keeps its note. It is still generated from the deleted strings, and the release build does not run take-template yet. - If you won't ship with an unpinned bundle, the alternative is to keep scaffold.ts until the pin lands.

• 2. Direction. I'm not claiming this is pipeline-first. It is #10305, and I have no argument against deferring it if the pipeline items take priority.
• 3. Script tests. test/template-scripts.test.ts runs both scripts on local git fixtures and checks these cases:

- take-template records HEAD and the tracked files. - take-template refuses a binary file and a checkout with no template.json. - birth-check boots a good template. - birth-check exits 1 for a template that doesn't boot.

• 3. Port. birth-check now asks the kernel for a free port and retries up to 3 times if the app fails to come up.
• 4. Binary files. take-template reads bytes, decodes them strictly, and refuses any file that is not UTF-8 text or contains a NUL byte.
• 5. apps.template. I stated in docs/features/app-template.md that it is operator-only on purpose, rather than adding a page and TUI control. Which repository every new app copies is a forge-wide choice. Owners pick another template per app with template:.
• 6. Two forms. I kept both template.json forms. A test pins that each parser rejects the other's form, and the docs describe both.
• src/apps/template.ts.

- Path traversal: files names go through safePath (no dot segments, .git, absolute paths, backslashes or control bytes), and the existing test covers it. Paths read from the tip are checked the same way. - Size caps: the tip copy had its own caps (1 MB per file, 8 MB total). It now uses the shared ones from template_tip.ts (500 files, 512 KiB per file, 4 MiB total). A new test shows an oversize file falls back to the image's copy.

I merged main into this branch and pushed it. tsc --noEmit and scripts/gate.ts are clean, and the 360 tests I ran in the 51 spawn, template, scaffold, job-slices and security-floor-doors files pass (4 skipped, 0 failed). I did not run the whole suite; the forge's check does that on this push.

• src/spawn/host.ts: main had moved the due-run wake timer's body into a named due function, and this branch had changed the same timer. I kept main's version, which still runs inside during("spawn-due-wake").
• test/job-slices.test.ts: after the merge, spawn-due-wake was listed twice in the untimed slices, which tsc rejected. I removed this branch's entry and kept the one main added, since its reason text is the more precise.

bun scripts/fast.ts exited 2 (the diff is too broad to name test files), so I picked those test files myself.

The sandbox blocked network and git spawns in some spawn tests, and they still passed.