@teamscala/service-boot 0.23.284

package/src/scala-tools-currency-watchdog.ts

@@ -0,0 +1,160 @@
+/**
+ * @system server-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * Polls the installed scala-tools package against GitHub Packages and repairs
+ * stale daemon tooling by reinstalling and letting PM2 restart the process.
+ */
+
+import { recordEvent } from "@teamscala/event-log/record-event";
+import { getAppLogger } from "@teamscala/logger/app-loggers";
+import { spawn } from "@teamscala/os/spawn";
+import { createWatchdog } from "@teamscala/watchdog/create-watchdog";
+import type { WatchdogHandle } from "@teamscala/watchdog/types";
+import { loadRegistryConfig } from "@teamscala/db/registry/load-config";
+import { decryptSecretConfig } from "@teamscala/encryption/crypto/secret-config";
+import * as v from "valibot";
+
+const PACKAGE_NAME = "@teamscala/scala-tools";
+const PACKAGE_PATH = "node_modules/@teamscala/scala-tools/package.json";
+const PACKAGE_URL = "https://npm.pkg.github.com/@teamgbg%2Fscala-tools";
+const POLL_INTERVAL_MS = 120_000;
+
+const DEFAULT_COMMAND_TIMEOUT_MS = 600_000;
+const DEFAULT_FETCH_TIMEOUT_MS = 10_000;
+const CurrencyConfigSchema = v.looseObject({
+	command_timeout_ms: v.optional(v.number(), DEFAULT_COMMAND_TIMEOUT_MS),
+	fetch_timeout_ms: v.optional(v.number(), DEFAULT_FETCH_TIMEOUT_MS),
+});
+let cachedCurrencyConfig: { command_timeout_ms: number; fetch_timeout_ms: number } | null = null;
+async function getCurrencyConfig(): Promise<{ command_timeout_ms: number; fetch_timeout_ms: number }> {
+	if (cachedCurrencyConfig) return cachedCurrencyConfig;
+	const cfg = await loadRegistryConfig("config", "scala-tools-currency", CurrencyConfigSchema);
+	cachedCurrencyConfig = {
+		command_timeout_ms: cfg?.command_timeout_ms ?? DEFAULT_COMMAND_TIMEOUT_MS,
+		fetch_timeout_ms: cfg?.fetch_timeout_ms ?? DEFAULT_FETCH_TIMEOUT_MS,
+	};
+	return cachedCurrencyConfig;
+}
+
+let cachedGithubToken: string | null | undefined;
+async function getGithubPackagesToken(): Promise<string | null> {
+	if (cachedGithubToken !== undefined) return cachedGithubToken;
+	const raw = await loadRegistryConfig("secret", "github-packages-token", v.unknown());
+	if (!raw) {
+		cachedGithubToken = null;
+		return null;
+	}
+	const decrypted = decryptSecretConfig(raw as never) as Record<string, unknown>;
+	cachedGithubToken = typeof decrypted.token === "string" ? decrypted.token : null;
+	return cachedGithubToken;
+}
+
+interface PackageManifest {
+	version?: unknown;
+}
+
+interface PackagePackument {
+	"dist-tags"?: { latest?: unknown };
+}
+
+let watchdog: WatchdogHandle | null = null;
+
+async function readInstalledVersion(cwd: string): Promise<string | null> {
+	try {
+		const manifest = (await Bun.file(`${cwd}/${PACKAGE_PATH}`).json()) as PackageManifest;
+		return typeof manifest.version === "string" ? manifest.version : null;
+	} catch {
+		return null;
+	}
+}
+
+async function readLatestVersion(fetchTimeoutMs: number): Promise<string | null> {
+	const token = await getGithubPackagesToken();
+	if (!token) return null;
+	try {
+		const response = await fetch(PACKAGE_URL, {
+			headers: {
+				accept: "application/vnd.github+json",
+				authorization: `Bearer ${token}`,
+			},
+			signal: AbortSignal.timeout(fetchTimeoutMs),
+		});
+		if (!response.ok) return null;
+		const packument = (await response.json()) as PackagePackument;
+		const latest = packument["dist-tags"]?.latest;
+		return typeof latest === "string" ? latest : null;
+	} catch {
+		return null;
+	}
+}
+
+async function checkCurrency(): Promise<{ healthy: boolean; details?: Record<string, unknown> }> {
+	const logger = getAppLogger();
+	const cwd = process.cwd();
+	const cfg = await getCurrencyConfig();
+	const installed = await readInstalledVersion(cwd);
+	const latest = await readLatestVersion(cfg.fetch_timeout_ms);
+	if (!installed || !latest) {
+		return {
+			healthy: true,
+			details: { installed, latest, action: "skipped-unavailable-input" },
+		};
+	}
+	if (installed === latest) {
+		return { healthy: true, details: { installed, latest, action: "current" } };
+	}
+
+	logger.warn("scala-tools.currency.stale", { installed, latest, cwd });
+	recordEvent({
+		kind: "scala.tools.currency.stale",
+		payload: { package: PACKAGE_NAME, installed, latest, cwd },
+	});
+	const result = await spawn({
+		name: "scala-tools-currency-repair",
+		command: ["node_modules/.bin/scala-tools", "deps", "install", "--dir", cwd, "--force-resolve"],
+		cwd,
+		timeoutMs: cfg.command_timeout_ms,
+		captureStderr: true,
+	});
+	if (result.exitCode !== 0) {
+		logger.error("scala-tools.currency.repair_failed", {
+			installed,
+			latest,
+			exitCode: result.exitCode,
+			stderr: result.stderr.slice(0, 1000),
+		});
+		recordEvent({
+			kind: "scala.tools.currency.repair.failed",
+			payload: { package: PACKAGE_NAME, installed, latest, exitCode: result.exitCode },
+		});
+		return { healthy: false, details: { installed, latest, action: "repair-failed" } };
+	}
+
+	recordEvent({
+		kind: "scala.tools.currency.repaired",
+		payload: { package: PACKAGE_NAME, installed, latest },
+	});
+	logger.info("scala-tools.currency.repaired", { installed, latest });
+	setTimeout(() => process.exit(0), 25);
+	return { healthy: true, details: { installed, latest, action: "repaired-restarting" } };
+}
+
+export function startScalaToolsCurrencyWatchdog(): void {
+	if (watchdog) return;
+	watchdog = createWatchdog("scala-sentinel:scala-tools-currency", {
+		intervalMs: POLL_INTERVAL_MS,
+		runOnStart: false,
+		check: checkCurrency,
+		onDegraded: (result) => {
+			getAppLogger().error("scala-tools.currency.degraded", result.details ?? {});
+		},
+	});
+	watchdog.start();
+}
+
+export function stopScalaToolsCurrencyWatchdog(): void {
+	watchdog?.stop();
+	watchdog = null;
+}

package/src/security-headers.ts

@@ -0,0 +1,59 @@
+/**
+ * @system server-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * Middleware that injects security headers into every response.
+ * Uses Hono's secureHeaders as the base for standard headers (X-Content-Type-Options,
+ * X-Frame-Options, Referrer-Policy, etc.), then layers registry-driven CSP with
+ * nonce injection on top.
+ */
+
+import { getConfigObject } from "@teamscala/db/registry/config";
+import type { Context, Next } from "hono";
+import { secureHeaders } from "hono/secure-headers";
+
+const FALLBACK_CSP = [
+	"script-src 'self'",
+	"style-src 'self' 'unsafe-inline' https://fonts.googleapis.com",
+	"default-src 'self'",
+	"img-src 'self' data:",
+	"connect-src 'self'",
+	"font-src 'self' https://fonts.gstatic.com",
+	"frame-ancestors 'none'",
+	"base-uri 'self'",
+	// Allow the platform's own *.scala.business origins as form targets so a
+	// cross-service form POST that 302-redirects (e.g. proposal Accept & Sign on
+	// proposals.scala.business redirecting to the agreement on sign.scala.business)
+	// is not blocked by form-action — CSP form-action governs the whole redirect
+	// chain, and 'self' alone blocks the cross-origin hop.
+	"form-action 'self' https://*.scala.business",
+].join("; ");
+
+// X-Frame-Options is omitted: it only expresses DENY/SAMEORIGIN (can't
+// allow-list the platform's own *.scala.business origins), and when both are
+// present some browsers enforce it over CSP. Frame control is owned solely by
+// CSP frame-ancestors (registry security-headers config), which allows
+// platform self-framing — e.g. the GPT panel framing a forms page.
+const baseSecureHeaders = secureHeaders({ xFrameOptions: false });
+
+export async function injectSecurityHeaders(c: Context, next: Next) {
+	await baseSecureHeaders(c, async () => {});
+
+	const nonce = Bun.randomUUIDv7();
+	c.set("nonce", nonce);
+
+	const config = getConfigObject<Record<string, string>>("security-headers");
+	const cspTemplate = config?.["Content-Security-Policy"] || FALLBACK_CSP;
+	const csp = cspTemplate.replace(/\{\{nonce\}\}/g, nonce);
+
+	c.header("Content-Security-Policy", csp, { append: true });
+	if (config) {
+		for (const [key, value] of Object.entries(config)) {
+			if (key === "Content-Security-Policy") continue;
+			c.header(key, value);
+		}
+	}
+
+	await next();
+}

package/src/serve/serve-ws.test.ts

@@ -0,0 +1,135 @@
+/**
+ * @system server-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * Unit test for serve.ts WebSocket upgrade path. Spins up a real
+ * Hono + createBunWebSocket + Bun.serve, registers a WS route, connects
+ * a client, and asserts message round-trip.
+ *
+ * Catches the class of bugs where fetchWithPeerPort clones the Request
+ * on WS upgrade (commit 43bb02b8e fixed this). If any future change to
+ * serve.ts breaks upgrade identity, this test fails.
+ */
+
+import { afterEach, expect, test } from "bun:test";
+import { Hono } from "hono";
+import { createBunWebSocket } from "hono/bun";
+import type { ServeHandle } from "./serve.ts";
+import { serveStart } from "./serve.ts";
+
+const TEST_PORT = 49152;
+const WS_PATH = "/ws-test";
+
+let handle: ServeHandle | null = null;
+
+function setupTestServer(): ServeHandle {
+	const app = new Hono();
+	const { upgradeWebSocket } = createBunWebSocket();
+
+	app.get(
+		WS_PATH,
+		upgradeWebSocket(() => ({
+			onOpen(_evt, ws) {
+				const raw = ws.raw as { send: (data: string) => void } | undefined;
+				if (raw) {
+					raw.send("hello-from-server");
+				}
+			},
+			onMessage(evt, ws) {
+				const raw = ws.raw as { send: (data: string) => void } | undefined;
+				if (raw && typeof evt.data === "string") {
+					raw.send(`echo:${evt.data}`);
+				}
+			},
+		})),
+	);
+
+	const h = serveStart(app, {
+		port: TEST_PORT,
+		serviceSlug: "ws-test",
+		logger: { info: () => {}, warn: () => {} },
+	});
+	handle = h;
+	return h;
+}
+
+afterEach(() => {
+	if (handle) {
+		handle.stop();
+		handle = null;
+	}
+});
+
+test("WS upgrade succeeds and messages round-trip", async () => {
+	setupTestServer();
+
+	const ws = new WebSocket(`ws://127.0.0.1:${TEST_PORT}${WS_PATH}`);
+
+	const openPromise = new Promise<void>((resolve, reject) => {
+		const timer = setTimeout(
+			() => reject(new Error("WS connection timed out")),
+			5000,
+		);
+		ws.addEventListener("open", () => {
+			clearTimeout(timer);
+			resolve();
+		});
+		ws.addEventListener("error", (evt) => {
+			clearTimeout(timer);
+			reject(new Error(`WS error: ${String(evt)}`));
+		});
+	});
+
+	await openPromise;
+
+	const greeting = await new Promise<string>((resolve, reject) => {
+		const timer = setTimeout(
+			() => reject(new Error("greeting message timed out")),
+			5000,
+		);
+		ws.addEventListener("message", (evt) => {
+			clearTimeout(timer);
+			resolve(String(evt.data));
+		});
+	});
+	expect(greeting).toBe("hello-from-server");
+
+	const echoPromise = new Promise<string>((resolve, reject) => {
+		const timer = setTimeout(
+			() => reject(new Error("echo message timed out")),
+			5000,
+		);
+		ws.addEventListener("message", (evt) => {
+			clearTimeout(timer);
+			resolve(String(evt.data));
+		});
+	});
+	ws.send("ping");
+	const echo = await echoPromise;
+	expect(echo).toBe("echo:ping");
+
+	ws.close();
+});
+
+test("WS upgrade rejects on unknown path", async () => {
+	setupTestServer();
+
+	const ws = new WebSocket(`ws://127.0.0.1:${TEST_PORT}/nonexistent`);
+
+	const result = await new Promise<{ ok: boolean; code?: number }>(
+		(resolve) => {
+			const timer = setTimeout(() => resolve({ ok: true }), 5000);
+			ws.addEventListener("error", () => {
+				clearTimeout(timer);
+				resolve({ ok: false });
+			});
+			ws.addEventListener("close", (evt) => {
+				clearTimeout(timer);
+				resolve({ ok: false, code: evt.code });
+			});
+		},
+	);
+
+	expect(result.ok).toBe(false);
+});

package/src/serve/serve.ts

@@ -0,0 +1,190 @@
+/**
+ * @system runtime-serve
+ * @status handwritten
+ * @edit edit directly
+ *
+ * Listener primitives. Provides the Bun.serve production listener (serveStart)
+ * and the WebSocket upgrade helper (upgradeWebSocket) that work identically
+ * dev and prod.
+ */
+
+import type { Hono } from "hono";
+import { createBunWebSocket } from "hono/bun";
+
+const _bunWs = createBunWebSocket();
+
+/**
+ * Hono `upgradeWebSocket` helper bound to the same `createBunWebSocket()`
+ * pair that drives Bun.serve.websocket. Use exclusively from this package so
+ * the upgrade path and the message dispatch share state.
+ */
+export const upgradeWebSocket = _bunWs.upgradeWebSocket;
+
+export interface ServeOptions {
+	/** TCP port to bind. */
+	port: number;
+	/** For logging only. */
+	serviceSlug: string;
+	/**
+	 * Optional logger; defaults to console.
+	 */
+	logger?: { info(msg: string): void; warn(msg: string): void };
+}
+
+export interface ServeHandle {
+	server: ReturnType<typeof Bun.serve>;
+	stop(): void;
+}
+
+/**
+ * Create the fetch handler with peer-port injection. This function is
+ * shared between both the direct and mutable-ref modes.
+ */
+function createFetchHandler(
+	app: Hono,
+	serviceSlug: string,
+	logger: { info(msg: string): void; warn(msg: string): void },
+) {
+	let peerPortFailures = 0;
+	return async (
+		req: Request,
+		server: ReturnType<typeof Bun.serve>,
+	) => {
+		// app.fetch's second arg becomes c.env. Hono's bun WebSocket upgrade
+		// adapter checks `"server" in c.env` to find the Bun server reference;
+		// without { server }, /api/rpc/ws upgrade throws TypeError and the
+		// fleet relay can never subscribe.
+		//
+		// WebSocket upgrade requests MUST NOT be cloned — Bun's server.upgrade()
+		// tracks pending upgrades by Request identity, so a cloned Request can
+		// never upgrade. For WS requests we skip the peer-port clone and pass
+		// the original Request through.
+		const isUpgrade = req.headers.get("upgrade")?.toLowerCase() === "websocket";
+		if (isUpgrade) {
+			return app.fetch(req, { server });
+		}
+		try {
+			const peer = (
+				server as unknown as {
+					requestIP(r: Request): { port?: number; address?: string } | null;
+				}
+			).requestIP?.(req);
+			const port = peer?.port;
+			// x-caller-remote-address: the unforgeable transport-origin trust
+			// signal (no-client-controlled-trust-signals). server.requestIP is the
+			// ONE reliable address source (Hono's getConnInfo does not expose
+			// address on Bun). ALWAYS sanitize (delete any client-supplied spoof)
+			// then set the verified socket peer — the @teamscala/mcp-tool-runtime
+			// /mcp discriminator reads this to gate the bearer on loopback-only.
+			const address = peer?.address ?? null;
+			const needsPort =
+				typeof port === "number" &&
+				port > 0 &&
+				!req.headers.has("x-caller-remote-port");
+			if (needsPort || address !== null) {
+				const headers = new Headers(req.headers);
+				if (needsPort) headers.set("x-caller-remote-port", String(port));
+				if (address) {
+					headers.delete("x-caller-remote-address");
+					headers.set("x-caller-remote-address", String(address));
+				}
+				const cloned = new Request(req.url, {
+					method: req.method,
+					headers,
+					body: req.body,
+					signal: req.signal,
+					// @ts-expect-error duplex required by spec when body is a stream
+					duplex: "half",
+				});
+				return app.fetch(cloned, { server });
+			}
+		} catch (err) {
+			// Fail-open NOISY (protective-layers-fail-explicitly): the request
+			// must always be served, but a broken peer-port resolution degrades
+			// caller-identity to baked-stale headers. Aggregated: first +
+			// every 1000th, never per-request spam.
+			peerPortFailures++;
+			if (peerPortFailures === 1 || peerPortFailures % 1000 === 0) {
+				logger.warn(
+					`[boot-serve:${serviceSlug}] peer-port resolution failed ${peerPortFailures}x — caller-identity degrades to header fallback: ${err instanceof Error ? err.message : String(err)}`,
+				);
+			}
+		}
+		return app.fetch(req, { server });
+	};
+}
+
+/**
+ * Internal serve setup that's shared between both modes.
+ */
+function serveStartInternal(
+	fetchHandler: (req: Request, server: ReturnType<typeof Bun.serve>) => Promise<Response>,
+	options: ServeOptions,
+	logger: { info(msg: string): void; warn(msg: string): void },
+	mode: "direct" | "mutable-ref",
+): ServeHandle {
+	const server = Bun.serve({
+		port: options.port,
+		reusePort: true,
+		// Bun's default idleTimeout (~10s, swept on a coarse timer wheel)
+		// FIN-closes every pending connection in one ~2ms sweep once their
+		// handlers exceed it — packet-captured 2026-06-06: concurrent SSR
+		// requests all died at the same instant at 8.2-10.5s with clean
+		// server-side FINs while the renders completed and logged 200. THIS
+		// file is the serve path for kind:ui services (service-runtime's
+		// twin got the option first and the deploy changed nothing — the
+		// wrong twin). 120s bounds wedged connections without guillotining
+		// slow SSR.
+		idleTimeout: 120,
+		fetch: fetchHandler as never,
+		websocket: _bunWs.websocket,
+	});
+	// Export the actual listening port to process.env so loopback code reads the
+	// REAL port without a separate PORT injection. The central-tool-forwarder
+	// (chat tool dispatch) falls back to http://localhost:${PORT} for the
+	// co-located /mcp; without this export every chat tool call fails with
+	// "cannot resolve the /mcp base URL" (the highlight-ring end-to-end blocker,
+	// 2026-07-02). Respect Railway's $PORT when present.
+	if (!process.env.PORT) process.env.PORT = String(server.port);
+	logger.info(
+		`[runtime-serve:${options.serviceSlug}] Bun.serve listening on :${server.port} (${mode})`,
+	);
+	return {
+		server,
+		stop() {
+			server.stop(true);
+		},
+	};
+}
+
+/**
+ * Start Bun.serve listening on the configured port. Used by:
+ *   - bootUiService when running the production bundle (`bun dist/server/index.js`)
+ *   - bootBackendService for non-UI services
+ *
+ * UI services in dev mode also call this — they run `bun src/index.ts`
+ * directly under PM2 with the same Bun.serve listener.
+ *
+ * Two-phase boot variant: when useMutableRef is true, `app` is used as the
+ * initial app for the mutable reference (minimal tool-only surface), and the
+ * caller can swap to the full app later via swapApp().
+ */
+export function serveStart(
+	app: Hono,
+	options: ServeOptions,
+	useMutableRef = false,
+): ServeHandle {
+	const log = options.logger ?? console;
+
+	// For two-phase boot: initialize the mutable app reference with the
+	// minimal tool-only app. The caller will swap to the full app later.
+	if (useMutableRef) {
+		const { initMutableAppRef, fetchWithMutableApp } = require("../mutable-app-ref");
+		initMutableAppRef(app, "minimal");
+		return serveStartInternal(fetchWithMutableApp, options, log, "mutable-ref");
+	}
+
+	// Direct mode: use the app directly
+	const fetchHandler = createFetchHandler(app, options.serviceSlug, log);
+	return serveStartInternal(fetchHandler, options, log, "direct");
+}

package/src/server-error-page.test.ts

@@ -0,0 +1,102 @@
+/**
+ * @system service-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * Fixture suite for the branded HTML render-error page. Asserts the
+ * user-observable outcome (error-responses-via-error-report): a page render
+ * failure serves a branded HTML page — never JSON — carrying the status,
+ * Retry-After, and the errorId that ties the screen to GlitchTip + the log.
+ */
+
+import { describe, expect, test } from "bun:test";
+import type { ErrorReport } from "@teamscala/os/errors/error-report";
+import { buildServerErrorPageResponse } from "./server-error-page.ts";
+
+function transientReport(over: Partial<ErrorReport> = {}): ErrorReport {
+	return {
+		errorId: "abc-123",
+		name: "SafeFallbackTimeoutError",
+		code: "RENDER_TIMEOUT",
+		message: "safe-fallback exceeded 45000ms",
+		transient: true,
+		retryAfter: 5,
+		reason: "render timed out under load",
+		stackHead: "",
+		http: { status: 503, body: {}, headers: {} },
+		...over,
+	};
+}
+
+function hardReport(over: Partial<ErrorReport> = {}): ErrorReport {
+	return {
+		errorId: "xyz-789",
+		name: "TypeError",
+		code: "UNKNOWN",
+		message: "cannot read properties of undefined",
+		transient: false,
+		stackHead: "",
+		http: { status: 500, body: {}, headers: {} },
+		...over,
+	};
+}
+
+describe("buildServerErrorPageResponse", () => {
+	test("transient report → 503 HTML page with Retry-After + transient heading + errorId", async () => {
+		const res = buildServerErrorPageResponse(transientReport());
+		expect(res.status).toBe(503);
+		expect(res.headers.get("content-type")).toContain("text/html");
+		expect(res.headers.get("retry-after")).toBe("5");
+		expect(res.headers.get("cache-control")).toBe("no-store, no-transform");
+		const html = await res.text();
+		// transient wording, not the hard-error wording (apostrophe is escaped)
+		expect(html).toContain("taking longer");
+		expect(html).not.toContain("load this page");
+		// errorId present for browser↔GlitchTip correlation
+		expect(html).toContain("abc-123");
+	});
+
+	test("hard error report → 500 HTML page, no Retry-After, error heading", async () => {
+		const res = buildServerErrorPageResponse(hardReport());
+		expect(res.status).toBe(500);
+		expect(res.headers.get("retry-after")).toBeNull();
+		const html = await res.text();
+		expect(html).toContain("load this page");
+		// the real message is shown so the operator has an explanation
+		expect(html).toContain("cannot read properties of undefined");
+		expect(html).toContain("xyz-789");
+	});
+
+	test("logo is embedded when provided, omitted when not", async () => {
+		const withLogo = buildServerErrorPageResponse(transientReport(), "/assets/logo.png");
+		expect((await withLogo.text())).toContain('src="/assets/logo.png"');
+		const noLogo = buildServerErrorPageResponse(transientReport());
+		expect((await noLogo.text())).not.toContain("<img");
+	});
+
+	test("logo ships INLINE as a data URI with reserved width+height (no post-paint proxy pop-in)", async () => {
+		// resolveErrorPageLogo returns a data URI; the builder must emit it
+		// verbatim with reserved width+height so the logo paints in the INITIAL
+		// HTML bytes — never a /api/assets/ proxy <img> that pops in after paint
+		// and fails under degraded conditions (logos-inline-on-branded-server-pages,
+		// operator-observed 2026-07-27 on a DEGRADED render-layer holding page).
+		const dataUri = "data:image/png;base64,iVBORw0KGgoAAAENSUhEUg==";
+		const res = buildServerErrorPageResponse(transientReport(), dataUri);
+		const html = await res.text();
+		expect(html).toContain(`src="${dataUri}"`);
+		expect(html).toContain('width="160"');
+		expect(html).toContain('height="40"');
+		// no proxy fetch — the logo is in the bytes, not a second request
+		expect(html).not.toContain('src="/api/assets/');
+	});
+
+	test("html-escapes the explanation + errorId (no XSS injection)", async () => {
+		const res = buildServerErrorPageResponse(
+			hardReport({ message: "<script>alert(1)</script>", errorId: "<b>" }),
+		);
+		const html = await res.text();
+		expect(html).not.toContain("<script>alert(1)</script>");
+		expect(html).toContain("&lt;script&gt;");
+		expect(html).not.toContain("<b>");
+	});
+});