@bongos/core 1.24.52 → 1.24.53

package/src/link-preview.js

@@ -0,0 +1,71 @@
+// src/link-preview.js — the one link-preview card every public page carries (task 1005091,
+// goal 1000138).
+//
+// When someone pastes a link to the projects hub, the community page, the status page, the
+// API docs or the raise page into a chat, the preview is built from Open Graph and Twitter
+// card tags. Without them a chat shows a bare URL, or the first image it happens to find. So
+// every served page gets the same card: the page's own <title> and description, the
+// instance's product name as the site, and one 1200x630 image drawn from the shared mark
+// (modules/ui-design/public/brand/og-card.png, written by scripts/bongos/gen-brand.js --png
+// in the pack's colours).
+//
+// ONE TEMPLATE, APPLIED WHERE PAGES ARE SERVED: serve-internal.js injectBrandingGlobal (the
+// landing and hub pages, the status page, the API docs), the off-box status mirror (so it
+// still matches the live page), and the raise views through the module doorway. A page that
+// already writes its own card (the apex landing, which has its own og-card.jpg) keeps it:
+// the template steps aside when it finds an og:title.
+//
+// Pure: everything it reads is a parameter. The image URL is absolute when the instance has
+// a public origin (a chat fetches it from elsewhere), root-relative otherwise.
+
+'use strict';
+
+const { escapeHtml } = require('./html-escape');
+
+const CARD_PATH = '/modules/ui-design/public/brand/og-card.png';
+const CARD_SIZE = { width: 1200, height: 630 };
+
+// The page's own title and description, as text. They arrive already escaped (they were
+// written into the page), so the entities are decoded once and re-escaped on the way out.
+const DECODE = { amp: '&', lt: '<', gt: '>', quot: '"', '#39': "'" };
+const decode = (s) => String(s || '').replace(/&(amp|lt|gt|quot|#39);/g, (_, k) => DECODE[k]).trim();
+function pageMeta(html) {
+  const title = /<title>([\s\S]*?)<\/title>/i.exec(html);
+  const desc = /<meta\s+name="description"\s+content="([^"]*)"/i.exec(html);
+  return { title: decode(title && title[1]), description: decode(desc && desc[1]) };
+}
+
+/** The card's tags for a page, or '' when the page already writes its own. */
+function linkPreviewTags(html, brand = {}, origin = '') {
+  const page = String(html == null ? '' : html);
+  if (/<meta\s+property="og:title"/i.test(page)) return '';
+  const site = (brand.identity && brand.identity.productName) || '';
+  const { title, description } = pageMeta(page);
+  const t = title || site;
+  const d = description || (brand.copy && brand.copy.tagline) || '';
+  const image = `${String(origin || '').replace(/\/+$/, '')}${CARD_PATH}`;
+  const alt = site ? `The ${site} mark` : 'The mark';
+  const tag = (attr, key, value) => `<meta ${attr}="${key}" content="${escapeHtml(value)}">`;
+  return [
+    tag('property', 'og:type', 'website'),
+    site ? tag('property', 'og:site_name', site) : '',
+    tag('property', 'og:title', t),
+    d ? tag('property', 'og:description', d) : '',
+    tag('property', 'og:image', image),
+    tag('property', 'og:image:width', String(CARD_SIZE.width)),
+    tag('property', 'og:image:height', String(CARD_SIZE.height)),
+    tag('property', 'og:image:alt', alt),
+    tag('name', 'twitter:card', 'summary_large_image'),
+    tag('name', 'twitter:title', t),
+    d ? tag('name', 'twitter:description', d) : '',
+    tag('name', 'twitter:image', image),
+  ].join('');
+}
+
+/** The page with the card inserted at the end of its <head> (unchanged when it has one). */
+function applyLinkPreview(html, brand = {}, origin = '') {
+  const tags = linkPreviewTags(html, brand, origin);
+  return tags && String(html).includes('</head>') ? String(html).replace('</head>', `${tags}</head>`) : String(html);
+}
+
+module.exports = { linkPreviewTags, applyLinkPreview, CARD_PATH };

package/src/module-api.js

@@ -81,7 +81,7 @@ const { sleep } = require('./sleep');
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.24.52'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.24.53'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/src/platform-server.js

@@ -46,6 +46,11 @@ const path = require('path');
 const express = require('express');
 const { mountInternalSurfaces, isStatusHost, isBuildersHost, injectBrandingGlobal } = require('./bongos/serve-internal');
 const { isApiShapedPath, apiNotFoundBody } = require('./bongos/api-path-404');
+const { errorHandlers } = require('./error-page');
+const { applyLinkPreview } = require('./link-preview');
+const { clientBranding, branding } = require('./branding');
+// The instance's public origin, for an absolute link-preview image URL ('' when unset).
+const safeOrigin = () => { try { return branding().domains.publicOrigin || ''; } catch { return ''; } };
 const moduleLoader = require('./module-loader/loader');
 const { start: startErrorTally, startDailySend: startErrorReports } = require('./module-loader/error-tally');
 const { isModuleEnabled } = require('./modules');
@@ -317,9 +322,14 @@ function buildPlatformApp() {
   // per request, because modules mount inside mountInternalSurfaces above. No
   // provider (the module is off, as on every instance but the hub) → next(),
   // and /raise falls through to the 404 tail like any unknown path.
+  // The module renders its own HTML, so the platform's one link-preview card (task
+  // 1005091) is added here, on the way out, to any page it sends.
   app.use('/raise', (req, res, next) => {
     const raise = isApexHost(req) && seams.resolveOptional('raise.web');
     if (!raise) return next();
+    const send = res.send.bind(res);
+    res.send = (body) => send(typeof body === 'string' && body.includes('</head>')
+      ? applyLinkPreview(body, clientBranding(), safeOrigin()) : body);
     Promise.resolve(raise.handle(req, res, next)).catch(next);
   });
   // THE ACCOUNT PAGE (task 1004259, ADR 0337 D4.3): where a person edits what
@@ -402,15 +412,19 @@ function buildPlatformApp() {
   // or the builders' hall lands here. There is NO game to fall through to, so:
   //   * an API-shaped path gets a self-describing JSON 404 (never HTML), the
   //     same contract server.js gives so a mis-prefixed CLI call is legible;
-  //   * everything else gets a plain-text 404 — a game-less instance ships no
-  //     themed island page (public/404.html lives in the game module).
-  app.use((req, res) => {
-    res.status(404);
-    if (isApiShapedPath(req.path)) {
-      return res.json(apiNotFoundBody(req.path));
-    }
-    return res.type('text/plain').send('404 — not found');
+  //   * a browser asking for a page gets the branded 404 (src/error-page.js,
+  //     task 1005091), and any other client the plain-text 404 it always had.
+  // Then the trailing error net: a page route that throws answers the branded 500
+  // to a browser instead of Express's bare "Internal Server Error".
+  const { notFound, onError } = errorHandlers({
+    brandHtml: injectBrandingGlobal,
+    notFoundCopy: () => { try { return clientBranding().copy.notFound; } catch { return 'Page not found.'; } },
+    isApiShapedPath,
+    apiNotFoundBody,
+    log: (err, req) => logger.error({ err, method: req.method, url: req.originalUrl }, 'page request failed'),
   });
+  app.use(notFound);
+  app.use(onError);
 
   return app;
 }

package/tests/brand_surfaces.mjs

@@ -0,0 +1,213 @@
+// tests/brand_surfaces.mjs — the brand outside the hall (task 1005091, goal 1000138):
+// the link-preview card every public page carries, the branded 404 and 500 pages,
+// the themed API docs, the brand colour on Discord posts, and no maker's name written
+// into the portable landing.
+//
+// Behaviour, not spelling: the server is built and asked for pages over HTTP, the
+// error handlers and the link-preview template are called, and the Discord posters
+// send to a stubbed fetch whose bodies are read back.
+//
+// Run:  node --test tests/brand_surfaces.mjs
+
+import { test, before, after } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import http from 'node:http';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const { buildPlatformApp } = require('../src/platform-server.js');
+const { linkPreviewTags, applyLinkPreview, CARD_PATH } = require('../src/link-preview.js');
+const { errorPageTemplate, errorHandlers } = require('../src/error-page.js');
+const { applyBrandTokens, injectBrandingGlobal } = require('../src/bongos/serve-internal.js');
+const { clientBranding } = require('../src/branding.js');
+const webhook = require('../modules/discord/webhook.js');
+const discordLib = require('../scripts/discord/lib.js');
+const { ogCardHtml } = require('../scripts/bongos/gen-brand.js');
+
+const BRAND = clientBranding();
+const PRODUCT = BRAND.identity.productName;
+
+let server;
+let port;
+before(async () => {
+  server = http.createServer(buildPlatformApp());
+  await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
+  port = server.address().port;
+});
+after(async () => { await new Promise((resolve) => server.close(resolve)); });
+
+// node:http, not fetch: fetch drops a Host override.
+function get(p, { host = '127.0.0.1', accept = 'text/html,application/xhtml+xml,*/*;q=0.8' } = {}) {
+  return new Promise((resolve, reject) => {
+    const req = http.request({ host: '127.0.0.1', port, path: p, headers: { Host: host, Accept: accept } }, (res) => {
+      let body = '';
+      res.setEncoding('utf8');
+      res.on('data', (c) => { body += c; });
+      res.on('end', () => resolve({ status: res.statusCode, type: res.headers['content-type'] || '', body }));
+    });
+    req.on('error', reject);
+    req.end();
+  });
+}
+
+// ── the link-preview card ───────────────────────────────────────────────────────
+test('the card is built from the page\'s own title and description, with the shared image', () => {
+  const html = '<html><head><title>Status &amp; more — Acme</title><meta name="description" content="What &quot;shipped&quot;."></head><body></body></html>';
+  const brand = { identity: { productName: 'Acme' }, copy: { tagline: 'unused' } };
+  const tags = linkPreviewTags(html, brand, 'https://acme.example/');
+  assert.ok(tags.includes('<meta property="og:title" content="Status &amp; more — Acme">'), 'escaped once, not twice');
+  assert.ok(tags.includes('<meta property="og:description" content="What &quot;shipped&quot;.">'));
+  assert.ok(tags.includes(`<meta property="og:image" content="https://acme.example${CARD_PATH}">`), 'absolute when the instance has an origin');
+  assert.ok(tags.includes('<meta name="twitter:card" content="summary_large_image">'));
+  assert.ok(tags.includes('<meta property="og:site_name" content="Acme">'));
+  assert.ok(linkPreviewTags('<title>x</title>', {}, '').includes(`content="${CARD_PATH}"`), 'root-relative with no origin');
+  // a page that writes its own card keeps it
+  assert.equal(linkPreviewTags('<head><meta property="og:title" content="own"></head>', brand, ''), '');
+  const applied = applyLinkPreview(html, brand, '');
+  assert.ok(applied.indexOf('og:image') < applied.indexOf('</head>'));
+});
+
+test('every served public page carries the card: status, docs, and anything branded', async () => {
+  const status = await get('/', { host: 'status.example.com' });
+  assert.equal(status.status, 200);
+  assert.match(status.body, new RegExp(`<meta property="og:image" content="[^"]*${CARD_PATH.replace(/[.]/g, '\\.')}">`));
+  assert.match(status.body, /<meta property="og:title" content="[^"]*build status">/);
+  const docs = await get('/docs');
+  assert.equal(docs.status, 200);
+  assert.match(docs.body, /<meta name="twitter:card" content="summary_large_image">/);
+  // the landing and hub pages go through the same injection
+  const landingLike = injectBrandingGlobal('<html><head><title>{{productName}} — community</title></head><body></body></html>', BRAND, {});
+  assert.ok(landingLike.includes(`<meta property="og:title" content="${PRODUCT} — community">`));
+});
+
+test('the card image is a 1200x630 PNG drawn from the shared mark', () => {
+  const png = fs.readFileSync(path.join(ROOT, 'modules', 'ui-design', 'public', 'brand', 'og-card.png'));
+  assert.equal(png.toString('ascii', 1, 4), 'PNG');
+  assert.deepEqual([png.readUInt32BE(16), png.readUInt32BE(20)], [1200, 630]);
+  const page = ogCardHtml({ markSvg: '<svg/>', name: 'Acme <Co>', fontLinks: ['https://f.example/x'], fontFamily: '"Manrope", sans-serif' });
+  assert.ok(page.includes('text-transform:lowercase'), 'the wordmark is lowercase (DESIGN.md "Naming")');
+  assert.ok(page.includes('Acme &lt;Co&gt;'), 'the name is escaped');
+  assert.ok(page.includes('data:image/svg+xml;base64,'), 'the mark is the shared file, embedded');
+});
+
+// ── the branded 404 and 500 ────────────────────────────────────────────────────
+test('a browser gets the branded 404; an API path keeps JSON; a non-HTML client keeps text', async () => {
+  const page = await get('/no-such-page');
+  assert.equal(page.status, 404);
+  assert.match(page.type, /text\/html/);
+  assert.ok(page.body.includes('<use href="/modules/ui-design/public/brand/mark.svg#mark"/>'), 'the shared mark');
+  assert.ok(page.body.includes(`<title>${BRAND.copy.notFound} · ${PRODUCT}</title>`), 'the pack\'s words and the product name');
+  assert.ok(page.body.includes(BRAND.theme.fonts.links[0].replace(/&/g, '&amp;')), 'the pack\'s faces');
+  assert.doesNotMatch(page.body, /\{\{/);
+
+  const api = await get('/api/bongos/no-such-thing', { accept: 'text/html' });
+  assert.equal(api.status, 404);
+  assert.match(api.type, /application\/json/);
+
+  const curl = await get('/no-such-page', { accept: 'text/plain' });
+  assert.equal(curl.status, 404);
+  assert.match(curl.type, /text\/plain/);
+});
+
+test('a page route that throws answers the branded 500 to a browser and JSON to the API', () => {
+  const logged = [];
+  const { onError } = errorHandlers({
+    brandHtml: (h) => applyBrandTokens(h, { identity: { productName: 'Acme' } }, '', '', '', '', ''),
+    notFoundCopy: () => 'Gone.', isApiShapedPath: (p) => p.startsWith('/api/'), apiNotFoundBody: () => ({}),
+    log: (err) => logged.push(err.message),
+  });
+  const res = () => {
+    const r = { headersSent: false, code: 0, ctype: '', body: null };
+    r.status = (c) => { r.code = c; return r; };
+    r.type = (t) => { r.ctype = t; return r; };
+    r.send = (b) => { r.body = b; return r; };
+    r.json = (b) => { r.ctype = 'json'; r.body = b; return r; };
+    return r;
+  };
+  const req = (p, accept) => ({ path: p, method: 'GET', accepts: (t) => (Array.isArray(t) ? (accept === 'html' ? 'html' : 'json') : accept === 'html') });
+  const page = res();
+  onError(new Error('boom'), req('/projects', 'html'), page, () => {});
+  assert.equal(page.code, 500);
+  assert.equal(page.ctype, 'html');
+  assert.ok(page.body.includes('Something went wrong on our side.') && page.body.includes('· Acme</title>'));
+  assert.doesNotMatch(page.body, /boom/, 'the error text never reaches the page');
+  const api = res();
+  onError(new Error('boom'), req('/api/bongos/x', 'html'), api, () => {});
+  assert.equal(api.ctype, 'json');
+  assert.equal(api.body.error.code, 'internal_error');
+  assert.deepEqual(logged, ['boom', 'boom']);
+  // the 404 template carries the pack's words for "not found"
+  assert.ok(errorPageTemplate(404, { notFound: 'Gone.' }).includes('<h1>Gone.</h1>'));
+});
+
+test('the error page and the docs write their dark tier twice, byte-identical', () => {
+  const twins = (src) => {
+    const a = src.match(/html\[data-theme="dark"\]\s*\{([^}]*)\}/);
+    const b = src.match(/@media \(prefers-color-scheme:\s*dark\)\s*\{\s*html:not\(\[data-theme\]\)\s*\{([^}]*)\}/);
+    assert.ok(a && b, 'both twins exist');
+    const norm = (s) => s.replace(/\s+/g, ' ').trim();
+    assert.equal(norm(b[1]), norm(a[1]));
+  };
+  twins(errorPageTemplate(404));
+  twins(fs.readFileSync(path.join(ROOT, 'public-docs', 'index.html'), 'utf8'));
+});
+
+// ── the API docs ───────────────────────────────────────────────────────────────
+test('the API docs load the brand: the scales, the mark, the pack\'s faces and a token theme for Redoc', async () => {
+  const r = await get('/docs');
+  assert.equal(r.status, 200);
+  assert.ok(r.body.includes('<link rel="stylesheet" href="/modules/ui-design/public/tokens.css">'));
+  assert.ok(r.body.includes('<use href="/modules/ui-design/public/brand/mark.svg#mark"/>'));
+  assert.ok(r.body.includes(BRAND.theme.fonts.links[0].replace(/&/g, '&amp;')), 'the pack\'s font link is spliced');
+  assert.match(r.body, /Redoc\.init\('\/docs\/openapi\.json', \{[^}]*theme: theme \}/);
+  assert.doesNotMatch(r.body, /system-ui, -apple-system, Segoe UI, Roboto/, 'the old system-font bar is gone');
+  assert.doesNotMatch(r.body, /#2b6cb0|#1a1a1a/, 'no off-pack colour');
+});
+
+// ── Discord ────────────────────────────────────────────────────────────────────
+async function capture(fn, envKey) {
+  const sent = [];
+  const realFetch = globalThis.fetch;
+  const prev = process.env[envKey];
+  process.env[envKey] = 'https://discord.example/api/webhooks/1/x';
+  globalThis.fetch = async (url, init) => { sent.push(JSON.parse(init.body)); return { ok: true, status: 200, json: async () => ({ id: '1' }), text: async () => '' }; };
+  try { await fn(); } finally {
+    globalThis.fetch = realFetch;
+    if (prev === undefined) delete process.env[envKey]; else process.env[envKey] = prev;
+  }
+  return sent;
+}
+
+test('a Discord broadcast is an embed in the pack\'s accent (a sample post)', async () => {
+  const accent = parseInt(BRAND.theme.colors.accent.slice(1), 16);
+  const sample = webhook.embedBody('**Shipped:** the status page now matches the hall.');
+  assert.deepEqual(sample, {
+    embeds: [{ description: '**Shipped:** the status page now matches the hall.', color: accent }],
+    allowed_mentions: { parse: [] },
+  });
+  assert.equal(webhook.embedBody('x', { theme: { colors: { accent: 'not-a-colour' } } }).embeds[0].color, undefined, 'no bar rather than a wrong one');
+  assert.equal(webhook.embedBody('y'.repeat(5000)).embeds[0].description.length, 4096);
+
+  const [moduleBody] = await capture(() => webhook.postWebhook('ship_news', 'shipped'), 'DISCORD_SHIP_NEWS_WEBHOOK');
+  assert.deepEqual(moduleBody, { embeds: [{ description: 'shipped', color: accent }], allowed_mentions: { parse: [] } });
+  const [coreBody] = await capture(() => discordLib.postWebhook('ship_news', 'shipped'), 'DISCORD_SHIP_NEWS_WEBHOOK');
+  assert.deepEqual(coreBody, moduleBody, 'the core twin posts the same embed');
+});
+
+// ── the portable landing names no maker ─────────────────────────────────────────
+test('the landing names its maker only from the pack, and drops the band when there is none', () => {
+  const src = fs.readFileSync(path.join(ROOT, 'modules', 'public-landing', 'public', 'index.html'), 'utf8');
+  const code = src.replace(/<!--(?!\/?brand-if)[\s\S]*?-->/g, '').replace(/\/\*[\s\S]*?\*\//g, '');
+  assert.doesNotMatch(code, /Verro|VERRO/, 'no maker\'s name written into the portable page');
+  const stamp = (name) => applyBrandTokens(src, { identity: { productName: 'Acme', worldName: 'Acme', company: { name, site: '', tagline: '' } } }, '', '', '', '', '');
+  const named = stamp('Rocket Labs');
+  assert.ok(named.includes('<p class="wordmark">Rocket Labs</p>'));
+  assert.ok(named.includes('Built by Rocket Labs, Acme is our way'));
+  assert.ok(named.includes('held by Rocket Labs or its pilot clients'));
+  const none = stamp('');
+  assert.doesNotMatch(none, /class="wrap verro"|held by|Built by ,/, 'the band and the line drop whole');
+});

package/tests/discord_board_broadcast.mjs

@@ -132,16 +132,29 @@ test('the emitter fires on FRESH opens only, and the listener is registered (sou
   assert.ok(manifest.consumes.includes('government'), 'the port consumption is declared');
 });
 
-test('#871 survives: the mention poster keeps parse:[] and rings only the explicit allowlist', () => {
-  const src = fs.readFileSync(path.join(ROOT, 'modules', 'discord', 'webhook.js'), 'utf8');
-  const block = src.slice(src.indexOf('async function postWebhookMentions'));
-  assert.match(block, /postCore\(channel, text, \{ parse: \[\], users \}\)/,
-    'content can never ping on its own — only the server-resolved ids ring');
-  const plain = src.slice(src.indexOf('async function postWebhook('), src.indexOf('async function postWebhookMentions'));
-  assert.match(plain, /postCore\(channel, text, \{ parse: \[\] \}\)/,
-    'the default poster stays fully suppressed — #871 verbatim');
-  assert.match(block, /slice\(0, 20\)/, 'the allowlist is sanity-bounded');
-  assert.match(block, /\^\\d\+\$/, 'only numeric snowflake ids survive the filter');
+test('#871 survives: the mention poster keeps parse:[] and rings only the explicit allowlist', async () => {
+  // Drive the two posters against a stubbed fetch and read the bodies they send
+  // (task 1005091 moved the plain poster onto an embed; the rule did not move).
+  const sent = [];
+  const realFetch = globalThis.fetch;
+  const prev = process.env.DISCORD_BOARD_ROOM_WEBHOOK;
+  process.env.DISCORD_BOARD_ROOM_WEBHOOK = 'https://discord.example/api/webhooks/1/x';
+  globalThis.fetch = async (url, init) => { sent.push(JSON.parse(init.body)); return { ok: true, status: 200, json: async () => ({ id: '9' }) }; };
+  try {
+    await webhook.postWebhookMentions('board_room', 'vote <@1> @everyone', ['111', '222', 'not-an-id', ...Array.from({ length: 30 }, (_, i) => String(1000 + i))]);
+    await webhook.postWebhook('board_room', 'plain @everyone');
+  } finally {
+    globalThis.fetch = realFetch;
+    if (prev === undefined) delete process.env.DISCORD_BOARD_ROOM_WEBHOOK; else process.env.DISCORD_BOARD_ROOM_WEBHOOK = prev;
+  }
+  const [ring, plain] = sent;
+  assert.deepEqual(ring.allowed_mentions.parse, [], 'content can never ping on its own — only the server-resolved ids ring');
+  assert.equal(ring.content, 'vote <@1> @everyone', 'the mention post stays message text, so its ids can ring');
+  assert.equal(ring.allowed_mentions.users.length, 20, 'the allowlist is sanity-bounded');
+  assert.ok(ring.allowed_mentions.users.every((u) => /^\d+$/.test(u)), 'only numeric snowflake ids survive the filter');
+  assert.deepEqual(plain.allowed_mentions, { parse: [] }, 'the default poster stays fully suppressed — #871 verbatim');
+  assert.equal(plain.content, undefined, 'the default poster sends an embed, not message text');
+  assert.equal(plain.embeds[0].description, 'plain @everyone');
   assert.ok(webhook.CHANNELS.has('board_room'), 'the channel key exists');
 });
 

package/tests/docs_openapi_route.mjs

@@ -67,7 +67,8 @@ test('/docs Redoc page points at the same-origin spec URL it now always serves',
     const res = await fetch(base + '/docs');
     assert.equal(res.status, 200);
     const html = await res.text();
-    assert.match(html, /spec-url="\/docs\/openapi\.json"/, 'Redoc host page fetches /docs/openapi.json');
+    // task 1005091: Redoc is started by Redoc.init with the page's theme, so the URL is its first argument
+    assert.match(html, /Redoc\.init\('\/docs\/openapi\.json'/, 'Redoc host page fetches /docs/openapi.json');
   });
 });