wip: guided standalone installation and workspace checks

tools/tht/internal/setup/files_test.go

@@ -207,6 +207,50 @@ func TestEnsureFilesRequiresExplicitNonInteractiveAnswers(t *testing.T) {
 	}
 }
 
+func TestCompleteSetupCreatesProtectedPlaceholdersThenRequiresUsableCredentials(t *testing.T) {
+	root := newProject(t, "complete setup")
+	for name, value := range map[string]string{
+		"THT_SETUP_WORKSPACE_REMOTE": "git@git.example.invalid:team/workspaces.git",
+		"THT_SETUP_WORKSPACE_BRANCH": "main",
+		"THT_SETUP_WORKSPACE_ACCESS": "ssh",
+	} {
+		t.Setenv(name, value)
+	}
+	request := Request{ProjectRoot: root, InstallationID: "local", Profile: "local", Complete: true, NonInteractive: true}
+	if _, err := EnsureFiles(request, strings.NewReader(""), ioDiscard{}); err == nil || !strings.Contains(err.Error(), "usable Pi credentials") {
+		t.Fatalf("first complete setup error = %v, want the placeholder guidance", err)
+	}
+	secretRoot := filepath.Join(root, "deploy", "local", "secrets")
+	for path, contents := range map[string]string{
+		filepath.Join(secretRoot, "pi-auth.json"):              "{\"deepseek\":{\"apiKey\":\"configured\"}}\n",
+		filepath.Join(secretRoot, "workspace-git-key"):         "private-key\n",
+		filepath.Join(secretRoot, "workspace-git-known-hosts"): "git.example.invalid ssh-ed25519 AAAA\n",
+	} {
+		if err := os.WriteFile(path, []byte(contents), 0o600); err != nil {
+			t.Fatal(err)
+		}
+	}
+	result, err := EnsureFiles(request, strings.NewReader(""), ioDiscard{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	environment, err := os.ReadFile(result.EnvironmentPath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, name := range []string{"THT_CATALOG_RUNTIME_PASSWORD_SOURCE", "THT_CATALOG_MIGRATOR_PASSWORD_SOURCE"} {
+		if !strings.Contains(string(environment), name+"=") {
+			t.Fatalf("complete environment misses %s: %s", name, environment)
+		}
+	}
+	for _, name := range []string{"catalog-runtime-password", "catalog-migrator-password"} {
+		contents, readErr := os.ReadFile(filepath.Join(secretRoot, name))
+		if readErr != nil || len(strings.TrimSpace(string(contents))) < 32 {
+			t.Fatalf("generated catalog password %s is unavailable or too short", name)
+		}
+	}
+}
+
 func TestEnsureFilesIncludesServerStorageLocations(t *testing.T) {
 	requireProjectedServerTestHost(t)
 	root := newProject(t, "server profile")