ensure-pipelines-host: ship Platform Host getOrCreate as Phase 4.0

[T-Nid (tyaginidhi)]

Summary

Promotes the BAP getOrCreate Platform-Host fast-path from "deferred / future iteration" to a shipped first-position option in the NoHost menu of ensure-pipelines-host Phase 3.C. For first-time tenants this is the lowest-friction path — no admin role required, idempotent, ~3–5 min — replacing the prior workaround of sending the user to make.powerapps.com to trigger PE provisioning manually and re-run the skill.

Phase 3.C menu — before vs after

Before (4 flat options):

1. Use an existing environment (install Pipelines app)
2. Create a brand-new dedicated host env (D365_ProjectHost — admin only)
3. Open PPAC and create one manually
4. Cancel — with a footer note saying "Platform-Environment auto-provisioning is intentionally not offered in this iteration."

After (Platform Host promoted to first position; the two Custom Host paths collapsed under one entry with a sub-prompt):

1. Provision a Platform Host (recommended) — calls getOrCreate, idempotent, no admin role
2. Set up a Custom Host → sub-prompt: (a) install Pipelines on existing env, (b) create brand-new env (admin), (c) Back
3. Open PPAC manually
4. Cancel

Wrong-tenant safety

PE is tenant-singleton and admin-non-deletable, so wrong-tenant provisioning is the highest-blast-radius action this skill takes. Mitigations:

1. Phase 1.4 tenant-identity gate now resolves the tenant display name (via Microsoft Graph /v1.0/organization) and echoes it alongside the tenant GUID + dev env URL.
2. Phase 4.0 pre-call confirmation gate echoes the tenant display name + GUID a second time, immediately before the getOrCreate call.
3. Idempotency — getOrCreate returns the existing PE (200 + alreadyExisted=true) on a tenant that already has one, rather than creating a duplicate.

plan-alm parity

plan-alm Phase 2 Q4 NoHost menu mirrors the new top-level shape and Custom Host sub-prompt. New WILL_PROVISION_PLATFORM aux flag is threaded through hostResolution.willProvisionPlatform in .last-pipeline.json so ensure-pipelines-host skips its 3.C re-prompt at execution time. render-alm-plan.js adds a host-card render arm for the new flag.

Bonus fixes (separate from the feature)

• Drops --allow-no-subscriptions from getAuthToken's az account get-access-token call — recent CLI versions reject the flag as an unrecognized argument on this subcommand, which was causing verify-alm-prerequisites.js to silently return null tokens. AGENTS.md guidance updated; same flag misuse fixed on az account show in activate-site/SKILL.md. (Note: PR Stop passing --allow-no-subscriptions to non-login az commands #143 shipped the same fix on main yesterday — this PR re-applies it on the PowerPagesALM branch since main hasn't been merged in yet.)
• Plugin version bumped 1.3.0 → 1.4.0.

Test plan

• node --test plugins/power-pages/scripts/tests/provision-platform-host.test.js — 20 new tests covering 200/202/403/401/400/timeout/transport-error/5xx-transient paths and URL/body/template invariants
• node --test plugins/power-pages/scripts/tests/refresh-alm-plan-data.test.js — assertions for new willProvisionPlatform flag in post-run reset
• node --test plugins/power-pages/scripts/tests/render-alm-plan.test.js — new fixture covering the willProvisionPlatform === true host-card render branch
• node --test plugins/power-pages/scripts/tests/validation-helpers.test.js — assertion inverted (helper must NOT pass --allow-no-subscriptions)
• Full plugin test suite: 592 / 597 pass; the 5 remaining failures are pre-existing render-alm-plan tests unrelated to this work (verified via git stash — same 5 fail at HEAD)
• Live test on a tenant that already has a PE → 200 idempotent path → alreadyExisted: true
• Live test on a fresh-PE-free tenant → 202 path → poll → Succeeded → alreadyExisted: false
• plan-alm UX walkthrough: pick Option 1 in Q4, confirm hostResolution.willProvisionPlatform = true lands in .alm-plan-data.json and the rendered host card

Files changed (13)

File	Change
plugins/power-pages/scripts/lib/provision-platform-host.js	new — getOrCreate helper
plugins/power-pages/scripts/tests/provision-platform-host.test.js	new — 20 tests
plugins/power-pages/skills/ensure-pipelines-host/SKILL.md	menu rewrite + Phase 4.0 + tenant-name capture + threat model + enum + telemetry
plugins/power-pages/skills/plan-alm/SKILL.md	Q4 menu + sub-prompt + flag thread + risks
plugins/power-pages/skills/plan-alm/scripts/render-alm-plan.js	willProvisionPlatform render arm
plugins/power-pages/scripts/lib/refresh-alm-plan-data.js	post-run reset adds new flag
plugins/power-pages/scripts/tests/refresh-alm-plan-data.test.js	assertions updated
plugins/power-pages/scripts/tests/render-alm-plan.test.js	new fixture
plugins/power-pages/scripts/lib/validation-helpers.js	drop --allow-no-subscriptions from getAuthToken
plugins/power-pages/scripts/tests/validation-helpers.test.js	inverted assertion
plugins/power-pages/skills/activate-site/SKILL.md	drop flag from az account show
plugins/power-pages/AGENTS.md	flag-usage guidance update
plugins/power-pages/.claude-plugin/plugin.json	version 1.3.0 → 1.4.0

🤖 Generated with Claude Code