@bongos/core 1.19.924 → 1.19.926

package/scripts/gds/provision-repo.js

@@ -91,6 +91,31 @@ const CORE_PKG_DIR = 'node_modules/@bongos/core';
 // one constant so the backup dir owner + the backup unit's User= can't drift from it.
 const APP_USER = 'lars';
 function standaloneRoot(inst, { base = CONFIG.standaloneBase } = {}) { return path.posix.join(base, inst.slug); }
+// WHERE THE INSTANCE THIS CORE SERVES ACTUALLY LIVES (task 1004123).
+//
+// REPO_ROOT is `path.resolve(__dirname, '..', '..')` — it points at whatever copy of
+// the core is EXECUTING, which is not the same place as the instance being upgraded.
+// Two shapes, and the code had only ever met the first:
+//
+//   • a core CHECKOUT run in place (`/home/lars/cloudbongos`) — the instance root IS
+//     the checkout, so REPO_ROOT was right by coincidence;
+//   • a VENDORED core (`<instance>/node_modules/@bongos/core`) — REPO_ROOT is the
+//     package, and the instance is three directories up.
+//
+// The live control plane became the second shape when its runner unit was re-homed
+// (`WorkingDirectory=/home/lars/cloudbongos-instance`, ExecStart into the vendored
+// core), and nothing noticed: REPO_ROOT still resolved, just to the wrong tree. So
+// `readInstalledCoreVersion` answered null instead of 1.19.917, every guard that
+// reads `installed` silently stopped guarding, and an upgrade would have pinned and
+// npm-installed INSIDE the core package while the instance's own pin stayed put.
+//
+// This is a string question, not a filesystem one: the vendored layout is the only
+// way a core ends up under `node_modules/`, so the suffix IS the answer. Keeping it
+// pure means the control-plane path is testable without a box.
+function selfInstanceRoot(repoRoot = REPO_ROOT) {
+  const suffix = path.sep + CORE_PKG_DIR.split('/').join(path.sep);
+  return repoRoot.endsWith(suffix) ? repoRoot.slice(0, -suffix.length) : repoRoot;
+}
 // Sync the instance's own repo (host content + the core pin). Mirrors deploy-instance.sh
 // step 1 — assumes the repo is already cloned at standaloneRoot (initial clone is a
 // precondition, like the runbook's `git pull`). Run with cwd = standaloneRoot.
@@ -1107,6 +1132,7 @@ module.exports = {
   safeVersionLabel,
   scaffoldStandaloneRepo,
   seedFirstVersionCmd,
+  selfInstanceRoot,
   standaloneInstallCmd,
   standaloneMigrateCmd,
   standalonePullCmd,

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.924'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.926'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/core_upgrade_door.mjs

@@ -456,5 +456,195 @@ await t('no verdict at all is null — never an implied pass', () => {
   assert.equal(p.behind, true, 'and the rest of the reading is unaffected');
 });
 
+
+console.log('\nthe body the page actually sends (task 1004124):');
+
+// THE REAL VALIDATOR, NOT A STUB. Every other handler test here injects
+// `validateOrRespond: () => false`, which is right for asserting branch behaviour and
+// is exactly why this shipped broken: the route declares `{ strict: true }`, so a field
+// the schema does not NAME is a 400 before the handler runs — and task 1004121 added
+// the `dry_run` read without the declaration. Two correct halves, one contract, and no
+// test across it. `src/bongos/routes/core-update.js` documents this same class in its
+// own comment; this is the provisioning half learning it.
+const HELPERS = require('../src/bongos/routes/_helpers.js');
+
+const validatorHarness = () => {
+  const calls = [];
+  const provisioning = {
+    getInstanceById: async () => ACTIVE,
+    enqueueIntent: async (_db, id, action, requestedBy, targetVersion) => {
+      calls.push({ id, action, requestedBy, targetVersion });
+      return { intent: { id: 1, action, state: 'pending', target_version: targetVersion }, created: true };
+    },
+    recordEvent: async () => {},
+  };
+  const handler = CU.makeCoreUpgradeHandler({
+    provisioning, pool: {}, parseId: () => 7,
+    validateOrRespond: HELPERS.validateOrRespond, log: { error() {} },
+  });
+  let body = null;
+  let status = 200;
+  const res = {
+    json: (b) => { body = b; return res; },
+    fail: (code, o) => { body = { code, ...(typeof o === 'object' ? o : { status: o }) }; status = (o && o.status) || o || 400; return res; },
+    status: (c) => { status = c; return res; },
+  };
+  return { calls, handler, res, read: () => ({ body, status }) };
+};
+
+await t('the preview payload the page posts is ACCEPTED, not refused as an unknown field', async () => {
+  // deploy.js:183 sends exactly `{ to, dry_run: true }`. Live, before the fix, this
+  // answered 400 unknown_field — so the whole "see what would change" button was dead.
+  const h = validatorHarness();
+  await h.handler({ builder: { id: 42 }, params: { id: '7' }, body: { to: '1.19.925', dry_run: true } }, h.res);
+  const { body } = h.read();
+  assert.ok(!body || body.code !== 'validation_failed', `the body must validate — got ${JSON.stringify(body)}`);
+  const queued = h.calls.find((c) => c.action === 'core-upgrade-preflight');
+  assert.ok(queued, 'and it reaches the queue as a PREVIEW, not as a move');
+});
+
+await t('the move payload still validates, and still queues a move', async () => {
+  const h = validatorHarness();
+  await h.handler({ builder: { id: 42 }, params: { id: '7' }, body: { to: '1.19.925' } }, h.res);
+  const { body } = h.read();
+  assert.ok(!body || body.code !== 'validation_failed', `the body must validate — got ${JSON.stringify(body)}`);
+  assert.ok(h.calls.find((c) => c.action === 'core-upgrade'), 'no dry_run means a real move');
+});
+
+await t('strict is still strict — a typo is still refused', async () => {
+  // The fix is a declaration, not a loosening. Widening to non-strict would have made
+  // the button work and silently swallowed every future typo, which is the trade
+  // _helpers.js exists to refuse.
+  const h = validatorHarness();
+  await h.handler({ builder: { id: 42 }, params: { id: '7' }, body: { to: '1.19.925', dry_runn: true } }, h.res);
+  const { body } = h.read();
+  assert.equal(body && body.code, 'validation_failed', 'an undeclared field is still a 400');
+  assert.equal(h.calls.length, 0, 'and nothing was queued');
+});
+
+await t('dry_run must be a boolean — a truthy string does not become a preview', async () => {
+  const h = validatorHarness();
+  await h.handler({ builder: { id: 42 }, params: { id: '7' }, body: { to: '1.19.925', dry_run: 'yes' } }, h.res);
+  const { body } = h.read();
+  assert.equal(body && body.code, 'validation_failed',
+    'the handler compares === true, so a string would silently queue a MOVE where a preview was asked for');
+});
+
+
+// A REAL REQUEST THROUGH THE ASSEMBLED ROUTER. The harness above proves the SCHEMA
+// (it injects the very function object the route injects — api.validateOrRespond IS
+// _helpers.validateOrRespond), but it cannot see the wiring: middleware order, a
+// missing body parser, a mis-shaped handler mount. Those are invisible to any test
+// that calls the factory directly, which is the same lesson
+// src/bongos/routes/core-update.js records about its own asyncHandler bug. So: boot
+// the actual router over express and POST to it.
+await t('a real POST through the assembled router accepts the preview body', async () => {
+  const api = require('../src/module-api.js');
+  const prov = require('../modules/provisioning/provisioning.js');
+  const routePath = require.resolve('../modules/provisioning/routes/core-upgrade.js');
+
+  const saved = {};
+  const stub = (obj, key, value) => {
+    saved[key] = Object.getOwnPropertyDescriptor(obj, key);
+    Object.defineProperty(obj, key, { value, configurable: true, writable: true });
+  };
+  // Only the two auth gates and the data layer are replaced. parseId and
+  // validateOrRespond stay REAL — they are the contract under test.
+  stub(api, 'requireBuilder', (req, _res, next) => { req.builder = { id: 42 }; next(); });
+  stub(api, 'requirePermission', () => (_req, _res, next) => next());
+  stub(api, 'pool', {});
+  const queued = [];
+  const savedProv = { get: prov.getInstanceById, enq: prov.enqueueIntent, rec: prov.recordEvent };
+  prov.getInstanceById = async () => ACTIVE;
+  prov.enqueueIntent = async (_db, id, action, requestedBy, targetVersion) => {
+    queued.push({ id, action, requestedBy, targetVersion });
+    return { intent: { id: 1, action, state: 'pending', target_version: targetVersion }, created: true };
+  };
+  prov.recordEvent = async () => {};
+  delete require.cache[routePath];
+
+  const express = require('express');
+  const app = express();
+  app.use(express.json());
+  app.use(require(routePath)());
+  const server = app.listen(0);
+  await new Promise((r) => server.once('listening', r));
+  try {
+    const res = await fetch(`http://127.0.0.1:${server.address().port}/provisioning/instances/41/core-upgrade`, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ to: '1.19.925', dry_run: true }),
+    });
+    const body = await res.json().catch(() => null);
+    assert.notEqual(res.status, 400, `the page's own payload must not be refused — got ${res.status} ${JSON.stringify(body)}`);
+    const preview = queued.find((q) => q.action === 'core-upgrade-preflight');
+    assert.ok(preview, `and it reaches the queue as a preview — queued ${JSON.stringify(queued)}`);
+    assert.equal(preview.targetVersion, '1.19.925');
+    assert.equal(preview.requestedBy, 'api:archon:42', 'attributed through the real auth seam');
+  } finally {
+    server.close();
+    for (const [k, d] of Object.entries(saved)) Object.defineProperty(api, k, d);
+    prov.getInstanceById = savedProv.get;
+    prov.enqueueIntent = savedProv.enq;
+    prov.recordEvent = savedProv.rec;
+    delete require.cache[routePath];
+  }
+});
+
+
+// THE AUDIT, AS A GUARD RATHER THAN A CLAIM. The task asked for a sweep of the other
+// provisioning write routes for this same shape. A sweep performed once and reported in
+// prose is indistinguishable, later, from one never performed — and the next route to
+// add a strict schema gets no help from it. So the sweep is a test: it re-runs on every
+// build and fails on the next occurrence rather than on this one.
+await t('every strict body schema in this module declares each field its handler reads', () => {
+  const dir = join(repoRoot, 'modules', 'provisioning');
+  const files = [];
+  const walk = (d) => {
+    for (const e of readdirSync(d, { withFileTypes: true })) {
+      if (e.name === 'node_modules' || e.name === 'tests') continue;
+      const full = join(d, e.name);
+      if (e.isDirectory()) walk(full);
+      else if (e.name.endsWith('.js')) files.push(full);
+    }
+  };
+  walk(dir);
+
+  const offenders = [];
+  let strictSites = 0;
+  for (const f of files) {
+    const src = readFileSync(f, 'utf8');
+    const lines = src.split('\n');
+    for (let i = 0; i < lines.length; i += 1) {
+      if (!lines[i].includes('validateOrRespond(req')) continue;
+      // The call spans until its `)) return;`; the handler body follows it.
+      let j = i;
+      while (j < lines.length && j < i + 40 && !lines[j].includes(')) return;')) j += 1;
+      const call = lines.slice(i, j + 1).join('\n');
+      if (!/strict:\s*true/.test(call)) continue;   // extras are ignored by design
+      strictSites += 1;
+      // The SCHEMA argument only — brace-matched from the `{` after `res,`. Scanning the
+      // whole call would also count the options object's keys as declared fields, which
+      // is exactly the kind of over-broad match that turns a guard into decoration.
+      const open = call.indexOf('{', call.indexOf('res,'));
+      let depth = 0;
+      let close = open;
+      for (; close < call.length; close += 1) {
+        if (call[close] === '{') depth += 1;
+        else if (call[close] === '}') { depth -= 1; if (!depth) break; }
+      }
+      const schemaSrc = call.slice(open, close + 1);
+      const declared = new Set([...schemaSrc.matchAll(/(\w+)\s*:\s*\{/g)].map((m) => m[1]));
+      const body = lines.slice(j + 1, j + 140).join('\n');
+      const read = new Set([...body.matchAll(/req\.body\.(\w+)/g)].map((m) => m[1]));
+      const missing = [...read].filter((k) => !declared.has(k));
+      if (missing.length) offenders.push(`${f.replace(repoRoot + '/', '')}:${i + 1} reads ${missing.join(', ')} but does not declare it`);
+    }
+  }
+  assert.ok(strictSites > 0, 'the scan found no strict schema at all — it has stopped looking');
+  assert.deepEqual(offenders, [],
+    'under strict, a field the schema does not name is a 400 BEFORE the handler runs, so reading it is unreachable code and a broken endpoint');
+});
+
 console.log(`\ncore_upgrade_door: ${passed} passed, ${failed} failed`);
 if (failed) process.exit(1);

package/tests/core_upgrade_runner.mjs

@@ -36,6 +36,7 @@ const R = require('../scripts/gds/provision-core-upgrade.js');
 const U = require('../scripts/gds/upgrade.js');
 const P = require('../modules/provisioning/provisioning.js');
 const G = require('../modules/provisioning/control-plane-guard.js');
+const RP = require('../scripts/gds/provision-repo.js');
 
 let passed = 0;
 let failed = 0;
@@ -553,5 +554,98 @@ await t('a preview of nothing is refused rather than cached as a pass', async ()
   assert.equal(d.queries.filter((q) => /INSERT INTO provisioning_core_version_snapshot/.test(q.sql)).length, 0);
 });
 
+console.log('\nwhere the instance actually is (task 1004123):');
+
+// The vendored layout the live control plane runs in: the core is a PACKAGE inside the
+// instance, so the directory the core executes from is three levels below the directory
+// that must be upgraded.
+const VENDORED = '/home/lars/cloudbongos-instance/node_modules/@bongos/core';
+const INSTANCE = '/home/lars/cloudbongos-instance';
+const LEGACY = '/home/lars/cloudbongos';
+
+await t('selfInstanceRoot walks out of a vendored core, and leaves a plain checkout alone', () => {
+  assert.equal(RP.selfInstanceRoot(VENDORED), INSTANCE, 'the package is not the instance');
+  assert.equal(RP.selfInstanceRoot(LEGACY), LEGACY, 'a checkout run in place IS the instance');
+});
+
+await t('a path that merely CONTAINS the package name is not mistaken for one', () => {
+  // Guarding the string test itself: only a trailing segment means "I am the vendored
+  // core", and an instance that happens to live under a similarly-named directory must
+  // not be truncated into nonsense.
+  const decoy = '/srv/node_modules/@bongos/core-tools';
+  assert.equal(RP.selfInstanceRoot(decoy), decoy);
+  assert.equal(RP.selfInstanceRoot('/srv/node_modules/@bongos/core/sub'), '/srv/node_modules/@bongos/core/sub');
+});
+
+await t('the runner reads the installed version from the INSTANCE, not from the core package', async () => {
+  // The defect this replaces: readInstalledCoreVersion was handed REPO_ROOT, which in
+  // the vendored shape holds no node_modules/@bongos/core at all — so it answered null
+  // on the live control plane for as long as the shape has existed.
+  const asked = [];
+  const d = { ...makeDeps({ served: '1.19.762' }), selfInstanceRoot: () => INSTANCE };
+  d.readInstalledCoreVersion = (dir) => { asked.push(dir); return '1.19.760'; };
+  await R.coreUpgradeInstance(inst({ hosting_shape: 'control-plane', slug: 'cloudbongos', port: 3002 }), d, intent());
+  assert.deepEqual(asked, [INSTANCE], 'asked the instance root exactly once');
+});
+
+await t('the CLI runs where it lives and NAMES the instance it is aimed at', async () => {
+  const d = { ...makeDeps({ served: '1.19.762' }), selfInstanceRoot: () => INSTANCE };
+  await R.coreUpgradeInstance(inst({ hosting_shape: 'control-plane', slug: 'cloudbongos', port: 3002 }), d, intent());
+  const cmd = upgradeCall(d);
+  assert.ok(cmd.includes(`--instance ${INSTANCE} `),
+    `without this the upgrade pins and installs inside the core package and the real pin never moves — got: ${cmd}`);
+});
+
+await t('the legacy shape still omits --instance, because there is nothing to disambiguate', async () => {
+  const d = { ...makeDeps({ served: '1.19.762' }), selfInstanceRoot: () => require('../scripts/gds/provision-config.js').REPO_ROOT };
+  await R.coreUpgradeInstance(inst({ hosting_shape: 'control-plane', slug: 'cloudbongos', port: 3002 }), d, intent());
+  assert.doesNotMatch(upgradeCall(d), /--instance /, 'a checkout run in place is its own instance');
+});
+
+await t('the version snapshot asks the registry from the instance, not from inside the package', async () => {
+  // Weakest of the three sites — `recommended` is derived from the box's own /version,
+  // so aiming this one wrongly changes no answer today. It is guarded anyway: npm reads
+  // its configuration from the directory it runs in, and an unguarded line is a line
+  // that regresses quietly. Found by mutating each of the three sites in turn; this was
+  // the one no test noticed.
+  const cwds = [];
+  const d = makeDeps({ served: '1.19.760' });
+  d.selfInstanceRoot = () => INSTANCE;
+  d.updateChannel = { ...d.updateChannel, listAvailableVersions: ({ cwd }) => { cwds.push(cwd); return { ok: true, versions: ['1.19.760', '1.19.762'] }; } };
+  await R.snapshotCoreVersions(inst({ hosting_shape: 'control-plane', slug: 'cloudbongos', port: 3002 }), d);
+  assert.deepEqual(cwds, [INSTANCE]);
+});
+
+await t('the PREVIEW aims at the instance too — a dry run of the wrong directory is the lie', async () => {
+  // This is the shape that made the defect dangerous rather than merely broken: dry-run
+  // against the core package and upgrade.js reports `(none) → <target>` with green
+  // pre-flight ticks, so the owner is shown a clean bill of health for a run that will
+  // restart production and roll back. Both legs share one builder; both must aim.
+  const box = { id: 41, slug: 'cloudbongos', port: 3002, hosting_shape: 'control-plane', db_name: 'cloudbongos' };
+  const selfRoot = () => INSTANCE;
+  const move = R.upgradeInvocation(box, '1.19.922', { privileged: true, selfRoot });
+  const peek = R.upgradeInvocation(box, '1.19.922', { privileged: true, dryRun: true, selfRoot });
+  assert.ok(peek.cmd.includes(`--instance ${INSTANCE} `), `the preview names its target — got: ${peek.cmd}`);
+  assert.equal(move.instanceDir, peek.instanceDir, 'and it is the same target the move would take');
+  assert.equal(peek.instanceDir, INSTANCE);
+});
+
+await t('an unreadable installed version is a REFUSAL, not a skipped channel check', () => {
+  // Fail-closed. This is the guard that would have caught the directory bug on the
+  // first press instead of after four live restarts.
+  const f = R.targetFault('1.19.760', ['1.19.758', '1.19.760'], null, 'patch', () => true);
+  assert.match(f, /could not read the core version installed/);
+  assert.match(f, /cannot be bounded by the 'patch' channel/);
+});
+
+await t('the runner refuses, and runs NOTHING, when it cannot see where the instance is', async () => {
+  const d = makeDeps({ served: '1.19.762' });
+  d.readInstalledCoreVersion = () => null;
+  const r = await R.coreUpgradeInstance(inst({ hosting_shape: 'control-plane', slug: 'cloudbongos', port: 3002 }), d, intent());
+  assert.equal(r.ok, false);
+  assert.match(r.error, /could not read the core version installed/);
+  assert.equal(d.ranWith.filter((c) => /upgrade\.js/.test(c.cmd)).length, 0, 'the box was not touched');
+});
+
 console.log(`\ncore_upgrade_runner: ${passed} passed, ${failed} failed`);
 if (failed) process.exit(1);

package/tests/helpers.mjs

@@ -630,5 +630,104 @@ export function bootProfilePage({ signedIn = true, trail = [] } = {}) {
   };
 }
 
+
+// bootIdeaPage — boot the REAL modules/hall-ui/public/idea.js in a vm against a
+// stub DOM, and hand back the HTML it wrote into #idea-body plus every request
+// it made.
+//
+// The sibling of bootProfilePage above, and here for the same reason: the
+// descent surface (task 1004094 / BV2.R10) is asserted at the RENDERED layer,
+// because the first of the three findings inherited from the abandoned task
+// 1004054 is that testing the server-side read alone is exactly how a renderer
+// bug survives. What a reader is handed is HTML, so that is what the suite reads.
+//
+// Unlike profile.js, this page writes straight into an element's innerHTML
+// rather than through OTBKit's ledger, so the capture is the element itself.
+const IDEA_JS = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/idea.js'), 'utf8');
+export function bootIdeaPage({ idea = null, status = 200, template = null, viewer = { id: 1 }, ideaId = '1' } = {}) {
+  const els = new Map();
+  const makeEl = () => ({
+    dataset: {}, style: {}, textContent: '', hidden: false, _html: '',
+    classList: { add() {}, remove() {}, toggle() { return false; }, contains() { return false; } },
+    setAttribute() {}, getAttribute() { return null; },
+    addEventListener() {},
+    querySelector() { return null; }, querySelectorAll() { return []; }, appendChild() {},
+    set innerHTML(v) { this._html = String(v); }, get innerHTML() { return this._html; },
+  });
+  const documentObj = {
+    title: '',
+    body: { dataset: { page: 'idea' } },
+    documentElement: { dataset: {}, style: {}, classList: { add() {}, remove() {} } },
+    getElementById(id) { if (!els.has(id)) els.set(id, makeEl()); return els.get(id); },
+    querySelector(sel) {
+      const id = String(sel).replace(/^#/, '');
+      // The mark control's button and error slot exist only once the page has
+      // rendered one. Returning a live element for every selector would make
+      // the boot look as though it had wired a control that is not on the page.
+      if (id === 'ig-mark-btn' || id === 'ig-mark-err') {
+        return /id="ig-mark-btn"/.test(els.get('idea-body')?.innerHTML || '') ? this.getElementById(id) : null;
+      }
+      return this.getElementById(id);
+    },
+    querySelectorAll() { return []; },
+    createElement() { return makeEl(); },
+    addEventListener() {},
+  };
+
+  const requests = [];
+  const client = {
+    inbox: {
+      getInboxId: async ({ id }) => {
+        requests.push(`/inbox/${id}`);
+        return { status, ok: status === 200, data: status === 200 ? { idea } : null };
+      },
+      getInboxTemplate: async () => {
+        requests.push('/inbox/template');
+        return template
+          ? { status: 200, ok: true, data: { template } }
+          : { status: 500, ok: false, data: null };
+      },
+      postInboxIdSpark: async () => ({ status: 200, ok: true, data: { idea } }),
+      deleteInboxIdSpark: async () => ({ status: 200, ok: true, data: { idea } }),
+    },
+    me: {
+      getMe: async () => {
+        requests.push('/me');
+        return viewer
+          ? { status: 200, ok: true, data: { builder: viewer } }
+          : { status: 401, ok: false, data: null };
+      },
+    },
+  };
+
+  const windowObj = {
+    __BRANDING__: {}, __MODULES__: { enabled: {} },
+    BongosClient: { createClient: () => client },
+    OTB: {
+      escapeHtml: (s) => String(s == null ? '' : s).replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c])),
+      $: (sel) => documentObj.querySelector(sel),
+      fmtDate: (iso) => String(iso ?? '').slice(0, 10),
+      toast() {},
+    },
+    location: { hostname: 'builders.cloudbongos.com', search: '', pathname: `/idea/${ideaId}`, assign() {} },
+    localStorage: { getItem: () => null, setItem() {} },
+    addEventListener() {},
+  };
+
+  const sandbox = {
+    window: windowObj, document: documentObj, location: windowObj.location,
+    console, setTimeout, clearTimeout, URLSearchParams,
+  };
+  sandbox.globalThis = sandbox;
+  vm.createContext(sandbox);
+  vm.runInContext(IDEA_JS, sandbox, { filename: 'idea.js' });
+
+  return {
+    requests,
+    html: () => documentObj.getElementById('idea-body').innerHTML,
+    title: () => documentObj.title,
+  };
+}
+
 // One microtask turn — profile.js boots through a chain of awaits.
 export const settle = () => new Promise((r) => setTimeout(r, 0));