7 changed files with 42 additions and 335 deletions
--- a/README.md
+++ b/README.md
@ -19,7 +19,7 @@ The package is published to the Debian registry of the forge itself. One-time se
 curl -fsSL https://forgejo.heavyduty.builders/heavy-duty/stoke/raw/branch/main/scripts/install-apt.sh | bash
 ```

-or manually. First add the forge's registry as an apt source:
+or manually:

 ```bash
 sudo install -d /etc/apt/keyrings
@ -27,24 +27,10 @@ curl -fsSL https://forgejo.heavyduty.builders/api/packages/heavy-duty/debian/rep
  | sudo tee /etc/apt/keyrings/forgejo-heavy-duty.asc >/dev/null
 echo "deb [signed-by=/etc/apt/keyrings/forgejo-heavy-duty.asc] https://forgejo.heavyduty.builders/api/packages/heavy-duty/debian stable main" \
  | sudo tee /etc/apt/sources.list.d/forgejo-heavy-duty.list
-```
-
-The package depends on `nodejs (>= 22.12)`, which the distro archives of Debian 13 (Node 20) and Ubuntu 24.04 (Node 18) cannot satisfy — on those distros, also add a Node 22 source such as [NodeSource](https://deb.nodesource.com):
-
-```bash
-curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key \
-  | sudo tee /etc/apt/keyrings/nodesource.asc >/dev/null
-echo "deb [signed-by=/etc/apt/keyrings/nodesource.asc] https://deb.nodesource.com/node_22.x nodistro main" \
-  | sudo tee /etc/apt/sources.list.d/nodesource.list
-```
-
-Then install:
-
-```bash
 sudo apt-get update && sudo apt-get install stoke
 ```

-Upgrades then arrive through regular `apt-get upgrade`. `install-apt.sh` performs all of the above, adding the NodeSource repository only when no already-configured apt source offers a new-enough nodejs.
+Upgrades then arrive through regular `apt-get upgrade`.

 Note: apt releases that verify OpenPGP with `sqv` (Debian 13+, apt >= 2.9) currently reject the signature Forgejo generates for its Debian registry (an upstream signing bug). `install-apt.sh` detects this and falls back to a `[trusted=yes]` source — integrity then relies on HTTPS to the forge. The script prefers the signed source, so setups heal automatically once the forge is fixed.

@ -471,15 +457,15 @@ Calls `GET /api/v1/repos/{owner}/{repo}/pulls/{number}`.

 ### `stoke pr comment`

-Add a comment to a pull request. Body is required (whitespace-only is rejected). When both `-b` and `--body-file` are set, **`--body-file` wins**.
+Add a comment to a pull request.

 ```text
 Options:
  -o, --owner <owner>    repository owner (required)
  -r, --repo <repo>      repository name (required)
  -n, --number <number>  pull request number (required)
-  -b, --body <body>      comment body (markdown; required unless --body-file)
-  --body-file <path>     read the comment body from a file (wins over -b)
+  -b, --body <body>      comment body (markdown)
+  --body-file <path>     read the comment body from a file
 ```

 ```bash
@ -490,24 +476,23 @@ Calls `POST /api/v1/repos/{owner}/{repo}/issues/{number}/comments`.

 ### `stoke pr review`

-Submit a review on a pull request. `approve` / `approved` may omit a body; `request-changes` and `comment` require a non-empty body (raw body is preserved — only emptiness is checked with `trim()`). When both `-b` and `--body-file` are set, **`--body-file` wins**.
+Submit a review on a pull request.

 ```text
 Options:
  -o, --owner <owner>      repository owner (required)
  -r, --repo <repo>        repository name (required)
  -n, --number <number>    pull request number (required)
-  --event <event>          approve|approved, request-changes|request_changes, comment (required)
-  -b, --body <body>        review body (markdown; required for request-changes and comment)
-  --body-file <path>       read the review body from a file (wins over -b)
+  --event <event>          review event: approve, request-changes|request_changes, comment (required)
+  -b, --body <body>        review body (markdown)
+  --body-file <path>       read the review body from a file
 ```

 ```bash
 stoke pr review -o heavy-duty -r stoke -n 3 --event approve -b "Ship it."
-stoke pr review -o heavy-duty -r stoke -n 3 --event request-changes --body-file notes.md
 ```

-Calls `POST /api/v1/repos/{owner}/{repo}/pulls/{number}/reviews`. Prints the review URL when the forge returns one.
+Calls `POST /api/v1/repos/{owner}/{repo}/pulls/{number}/reviews`.

 ### `stoke branch list`

--- a/package-lock.json
+++ b/package-lock.json
@ -1,12 +1,12 @@
 {
  "name": "stoke",
-  "version": "1.2.1",
+  "version": "1.2.0",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "stoke",
-      "version": "1.2.1",
+      "version": "1.2.0",
      "license": "ISC",
      "dependencies": {
        "commander": "^15.0.0"
--- a/package.json
+++ b/package.json
@ -1,6 +1,6 @@
 {
  "name": "stoke",
-  "version": "1.2.1",
+  "version": "1.2.0",
  "description": "CLI for the heavy-duty forge (Forgejo)",
  "main": "src/cli.js",
  "scripts": {
--- a/scripts/install-apt.sh
+++ b/scripts/install-apt.sh
@ -18,12 +18,9 @@ FORGE_URL="${FORGE_URL:-https://forgejo.heavyduty.builders}"
 OWNER="${OWNER:-heavy-duty}"
 DISTRIBUTION="${DISTRIBUTION:-stable}"
 COMPONENT="${COMPONENT:-main}"
-# Where apt configuration lives; overridable so tests can run against a
-# throwaway directory instead of the real /etc/apt.
-APT_ETC="${STOKE_APT_ETC:-/etc/apt}"

-KEYRING="$APT_ETC/keyrings/forgejo-$OWNER.asc"
-LIST="$APT_ETC/sources.list.d/forgejo-$OWNER.list"
+KEYRING="/etc/apt/keyrings/forgejo-$OWNER.asc"
+LIST="/etc/apt/sources.list.d/forgejo-$OWNER.list"

 SUDO=""
 if [ "$(id -u)" -ne 0 ]; then
@ -31,53 +28,15 @@ if [ "$(id -u)" -ne 0 ]; then
  SUDO="sudo"
 fi

-update_only_source() {
+update_only_this_source() {
  $SUDO apt-get update \
-    -o Dir::Etc::sourcelist="$1" \
+    -o Dir::Etc::sourcelist="$LIST" \
    -o Dir::Etc::sourceparts=/dev/null \
    -o APT::Get::List-Cleanup=0
 }

-# stoke needs Node.js >= 22.12 (commander 15), but the distro archives of
-# Debian 13 (nodejs 20.x) and Ubuntu 24.04 (nodejs 18.x) cannot satisfy
-# that, which would make `apt-get install stoke` fail with an unmet
-# dependency. When no configured source offers a new-enough nodejs, add the
-# NodeSource repository for Node 22 so the dependency resolves.
-NODE_MIN="22.12"
-node_candidate_ok() {
-  local candidate
-  # LC_ALL=C: the "Candidate:" label is localized.
-  candidate="$(LC_ALL=C apt-cache policy nodejs 2>/dev/null | sed -n 's/^  Candidate: //p')"
-  [ -n "$candidate" ] && [ "$candidate" != "(none)" ] || return 1
-  dpkg --compare-versions "${candidate#*:}" ge "$NODE_MIN"
-}
-
-ensure_nodejs_source() {
-  node_candidate_ok && return 0
-  # The verdict may just be stale package lists — refresh (best effort, a
-  # transient failure of an unrelated source must not abort) and re-check
-  # before adding anything.
-  echo "No apt source seems to provide nodejs >= $NODE_MIN; refreshing apt metadata ..."
-  $SUDO apt-get update || true
-  node_candidate_ok && return 0
-  local ns_keyring="$APT_ETC/keyrings/nodesource.asc"
-  local ns_list="$APT_ETC/sources.list.d/nodesource.list"
-  if [ -e "$ns_list" ]; then
-    echo "error: nodejs >= $NODE_MIN is unavailable and $ns_list already exists;" >&2
-    echo "refusing to overwrite it. Run 'apt-get update' if the list already pins" >&2
-    echo "Node 22, or point it at a Node >= 22 release, then re-run." >&2
-    exit 1
-  fi
-  echo "Adding NodeSource (Node 22) ..."
-  curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key | $SUDO tee "$ns_keyring" >/dev/null
-  echo "deb [signed-by=$ns_keyring] https://deb.nodesource.com/node_22.x nodistro main" \
-    | $SUDO tee "$ns_list" >/dev/null
-  update_only_source "$ns_list"
-  node_candidate_ok || { echo "error: still no nodejs >= $NODE_MIN available after adding NodeSource" >&2; exit 1; }
-}
-
 echo "Adding APT source for $FORGE_URL/$OWNER ..."
-$SUDO install -d -m 0755 "$APT_ETC/keyrings"
+$SUDO install -d -m 0755 /etc/apt/keyrings
 curl -fsSL "$FORGE_URL/api/packages/$OWNER/debian/repository.key" | $SUDO tee "$KEYRING" >/dev/null
 echo "deb [signed-by=$KEYRING] $FORGE_URL/api/packages/$OWNER/debian $DISTRIBUTION $COMPONENT" \
  | $SUDO tee "$LIST" >/dev/null
@ -87,7 +46,7 @@ echo "deb [signed-by=$KEYRING] $FORGE_URL/api/packages/$OWNER/debian $DISTRIBUTI
 # in the upstream signing library). Try the properly signed source first so
 # this heals automatically once the forge is fixed; otherwise fall back to
 # [trusted=yes] — package integrity then relies on HTTPS to our own forge.
-if ! update_only_source "$LIST"; then
+if ! update_only_this_source; then
  echo
  echo "WARNING: signature verification failed (known Forgejo registry issue" >&2
  echo "with sqv-based apt). Falling back to [trusted=yes]; transport" >&2
@ -95,11 +54,9 @@ if ! update_only_source "$LIST"; then
  echo
  echo "deb [trusted=yes] $FORGE_URL/api/packages/$OWNER/debian $DISTRIBUTION $COMPONENT" \
    | $SUDO tee "$LIST" >/dev/null
-  update_only_source "$LIST"
+  update_only_this_source
 fi

-ensure_nodejs_source
-
 $SUDO apt-get install -y stoke

 echo
--- a/src/cli.js
+++ b/src/cli.js
@ -679,20 +679,6 @@ pr
    }
  });

-// Map CLI review event names (and common Forgejo ReviewStateType tokens) to
-// the values this forge accepts on POST .../pulls/{n}/reviews.
-const REVIEW_EVENT_MAP = {
-  approve: 'APPROVED',
-  approved: 'APPROVED',
-  'request-changes': 'REQUEST_CHANGES',
-  request_changes: 'REQUEST_CHANGES',
-  comment: 'COMMENT',
-};
-
-function resolveReviewEvent(raw) {
-  return REVIEW_EVENT_MAP[String(raw).toLowerCase()] || null;
-}
-
 pr
  .command('show')
  .description('Show details of a pull request')
@ -704,15 +690,11 @@ pr
      const config = loadConfig();
      const client = ForgejoClient.fromConfig(config);
      const prData = await client.getPullRequest(options.owner, options.repo, options.number);
-      const author = prData.user?.login || '(unknown)';
-      const headRef = prData.head?.ref || '?';
-      const baseRef = prData.base?.ref || '?';
-      const mergeable = prData.mergeable == null ? 'unknown' : String(prData.mergeable);
      console.log(`!${prData.number} [${prData.state}] ${prData.title}`);
      console.log(`URL:        ${prData.html_url}`);
-      console.log(`Author:     ${author}`);
-      console.log(`Branch:     ${headRef} -> ${baseRef}`);
-      console.log(`Mergeable:  ${mergeable}`);
+      console.log(`Author:     ${prData.user.login}`);
+      console.log(`Branch:     ${prData.head.ref} -> ${prData.base.ref}`);
+      console.log(`Mergeable:  ${prData.mergeable}`);
      console.log(`Created:    ${prData.created_at}`);
      if (prData.body) {
        console.log('\n' + prData.body);
@ -730,8 +712,8 @@ pr
  .requiredOption('-o, --owner <owner>', 'repository owner')
  .requiredOption('-r, --repo <repo>', 'repository name')
  .requiredOption('-n, --number <number>', 'pull request number', parseId)
-  .option('-b, --body <body>', 'comment body (markdown; required unless --body-file)')
-  .option('--body-file <path>', 'read the comment body from a file (wins over -b)')
+  .option('-b, --body <body>', 'comment body (markdown)')
+  .option('--body-file <path>', 'read the comment body from a file')
  .action(async (options) => {
    try {
      const config = loadConfig();
@ -757,16 +739,22 @@ pr
  .requiredOption('-o, --owner <owner>', 'repository owner')
  .requiredOption('-r, --repo <repo>', 'repository name')
  .requiredOption('-n, --number <number>', 'pull request number', parseId)
-  .requiredOption('--event <event>', 'review event: approve|approved, request-changes|request_changes, comment')
-  .option('-b, --body <body>', 'review body (markdown; required for request-changes and comment)')
-  .option('--body-file <path>', 'read the review body from a file (wins over -b)')
+  .requiredOption('--event <event>', 'review event: approve, request-changes|request_changes, comment')
+  .option('-b, --body <body>', 'review body (markdown)')
+  .option('--body-file <path>', 'read the review body from a file')
  .action(async (options) => {
    try {
      const config = loadConfig();
      const client = ForgejoClient.fromConfig(config);
-      const event = resolveReviewEvent(options.event);
+      const eventMap = {
+        approve: 'APPROVED',
+        'request-changes': 'REQUEST_CHANGES',
+        request_changes: 'REQUEST_CHANGES',
+        comment: 'COMMENT',
+      };
+      const event = eventMap[options.event.toLowerCase()];
      if (!event) {
-        console.error(`Invalid review event: ${options.event}. Must be approve (or approved), request-changes (or request_changes), or comment.`);
+        console.error(`Invalid review event: ${options.event}. Must be approve, request-changes (or request_changes), or comment.`);
        process.exit(1);
      }
      const rawBody = readBodyOption(options) || '';
@ -774,11 +762,8 @@ pr
        console.error(`Review event ${options.event} requires a non-empty body. Use -b/--body or --body-file.`);
        process.exit(1);
      }
-      const result = await client.createPullRequestReview(options.owner, options.repo, options.number, event, rawBody);
+      await client.createPullRequestReview(options.owner, options.repo, options.number, event, rawBody);
      console.log(`Review submitted on !${options.number}: ${event}.`);
-      if (result && result.html_url) {
-        console.log(`URL: ${result.html_url}`);
-      }
    } catch (err) {
      console.error(`Failed to submit review: ${err.message}`);
      if (err.status) console.error(`HTTP status: ${err.status}`);
--- a/test/cli.test.js
+++ b/test/cli.test.js
@ -101,18 +101,6 @@ test('pr comment rejects a missing body before any network call', () => {
  }
 });

-test('pr comment rejects a whitespace-only body before any network call', () => {
-  const cfg = path.join(os.tmpdir(), `stoke-cfg-${process.pid}.json`);
-  fs.writeFileSync(cfg, JSON.stringify({ url: 'https://forge.test', token: 'tok' }));
-  try {
-    const res = run(['pr', 'comment', '-o', 'o', '-r', 'r', '-n', '1', '-b', '   '], { STOKE_CONFIG_FILE: cfg });
-    assert.equal(res.status, 1);
-    assert.match(res.stderr, /Comment body is required/);
-  } finally {
-    fs.unlinkSync(cfg);
-  }
-});
-
 test('pr review rejects an invalid event before any network call', () => {
  const cfg = path.join(os.tmpdir(), `stoke-cfg-${process.pid}.json`);
  fs.writeFileSync(cfg, JSON.stringify({ url: 'https://forge.test', token: 'tok' }));
@ -125,20 +113,6 @@ test('pr review rejects an invalid event before any network call', () => {
  }
 });

-test('pr review accepts approved as an alias for approve before any network call', () => {
-  const cfg = path.join(os.tmpdir(), `stoke-cfg-${process.pid}.json`);
-  fs.writeFileSync(cfg, JSON.stringify({ url: 'https://forge.test', token: 'tok' }));
-  try {
-    // Network fails; must not fail at event validation.
-    const res = run(['pr', 'review', '-o', 'o', '-r', 'r', '-n', '1', '--event', 'APPROVED'], { STOKE_CONFIG_FILE: cfg });
-    assert.equal(res.status, 1);
-    assert.doesNotMatch(res.stderr, /Invalid review event/);
-    assert.doesNotMatch(res.stderr, /requires a non-empty body/);
-  } finally {
-    fs.unlinkSync(cfg);
-  }
-});
-
 test('pr review request-changes rejects a missing body before any network call', () => {
  const cfg = path.join(os.tmpdir(), `stoke-cfg-${process.pid}.json`);
  fs.writeFileSync(cfg, JSON.stringify({ url: 'https://forge.test', token: 'tok' }));
@ -199,29 +173,18 @@ test('pr review preserves exact body-file whitespace through the CLI boundary',

  fs.writeFileSync(bodyFile, rawBody, 'utf8');

-  const TIMEOUT_MS = 5000;
-  let timer;
  const captured = await new Promise((resolve, reject) => {
-    const fail = (err) => {
-      clearTimeout(timer);
-      try { server.close(); } catch { /* already closed */ }
-      reject(err instanceof Error ? err : new Error(String(err)));
-    };
-
    const server = http.createServer((req, res) => {
      let data = '';
      req.setEncoding('utf8');
      req.on('data', (chunk) => { data += chunk; });
      req.on('end', () => {
        res.writeHead(200, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify({ id: 99, html_url: 'https://forge.test/reviews/99' }));
-        clearTimeout(timer);
-        server.close(() => resolve({ url: req.url, body: data, cliStatus: null }));
+        res.end(JSON.stringify({ id: 99 }));
+        server.close(() => resolve({ url: req.url, body: data }));
      });
    });

-    timer = setTimeout(() => fail(new Error(`CLI boundary test timed out after ${TIMEOUT_MS}ms`)), TIMEOUT_MS);
-
    server.listen(0, '127.0.0.1', async () => {
      const { port } = server.address();
      fs.writeFileSync(cfg, JSON.stringify({ url: `http://127.0.0.1:${port}`, token: 'tok' }));
@ -231,16 +194,13 @@ test('pr review preserves exact body-file whitespace through the CLI boundary',
          { STOKE_CONFIG_FILE: cfg },
        );
        if (res.status !== 0) {
-          fail(new Error(`CLI failed (status ${res.status}): ${res.stderr}`));
-          return;
+          server.close(() => reject(new Error(`CLI failed: ${res.stderr}`)));
        }
-        // Capture is resolved from the HTTP handler; assert exit 0 here via side channel.
-        // If the handler already resolved, attach status for the outer asserts.
      } catch (err) {
-        fail(err);
+        server.close(() => reject(err));
      }
    });
-  }).finally(() => clearTimeout(timer));
+  });

  try {
    assert.equal(captured.url, '/api/v1/repos/o/r/pulls/7/reviews');
@ -252,47 +212,3 @@ test('pr review preserves exact body-file whitespace through the CLI boundary',
    fs.unlinkSync(bodyFile);
  }
 });
-
-test('pr review prints the review URL from the API response', async () => {
-  const cfg = path.join(os.tmpdir(), `stoke-cfg-${process.pid}-url.json`);
-  const TIMEOUT_MS = 5000;
-  let timer;
-  const result = await new Promise((resolve, reject) => {
-    const fail = (err) => {
-      clearTimeout(timer);
-      try { server.close(); } catch { /* already closed */ }
-      reject(err instanceof Error ? err : new Error(String(err)));
-    };
-    const server = http.createServer((req, res) => {
-      let data = '';
-      req.on('data', (c) => { data += c; });
-      req.on('end', () => {
-        res.writeHead(200, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify({ id: 42, html_url: 'https://forge.test/pulls/7#issuecomment-42' }));
-      });
-    });
-    timer = setTimeout(() => fail(new Error('timeout')), TIMEOUT_MS);
-    server.listen(0, '127.0.0.1', async () => {
-      const { port } = server.address();
-      fs.writeFileSync(cfg, JSON.stringify({ url: `http://127.0.0.1:${port}`, token: 'tok' }));
-      try {
-        const res = await spawnAsync(
-          ['pr', 'review', '-o', 'o', '-r', 'r', '-n', '7', '--event', 'approve', '-b', 'LGTM'],
-          { STOKE_CONFIG_FILE: cfg },
-        );
-        clearTimeout(timer);
-        server.close(() => resolve(res));
-      } catch (err) {
-        fail(err);
-      }
-    });
-  }).finally(() => clearTimeout(timer));
-
-  try {
-    assert.equal(result.status, 0, result.stderr);
-    assert.match(result.stdout, /Review submitted on !7: APPROVED/);
-    assert.match(result.stdout, /URL: https:\/\/forge\.test\/pulls\/7#issuecomment-42/);
-  } finally {
-    fs.unlinkSync(cfg);
-  }
-});
--- a/test/install-apt.test.js
+++ b/test/install-apt.test.js
@ -1,136 +0,0 @@
-const { test } = require('node:test');
-const assert = require('node:assert/strict');
-const { spawnSync } = require('node:child_process');
-const fs = require('node:fs');
-const os = require('node:os');
-const path = require('node:path');
-
-const SCRIPT = path.join(__dirname, '..', 'scripts', 'install-apt.sh');
-
-// Runs install-apt.sh against a throwaway apt directory (STOKE_APT_ETC) with
-// every external command stubbed via PATH. Scenario knobs:
-//   candInitial        `apt-cache policy` Candidate before any update
-//   candAfterUpdate    Candidate after any `apt-get update`
-//   candAfterNodesource Candidate after an update once nodesource.list exists
-// The apt-cache stub localizes the "Candidate:" label unless LC_ALL=C is set,
-// so every scenario doubles as a regression test for locale-safe parsing.
-function runScenario({ candInitial, candAfterUpdate, candAfterNodesource, preexistingNodesourceList }) {
-  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'stoke-apt-test-'));
-  const bin = path.join(root, 'bin');
-  const state = path.join(root, 'state');
-  const aptEtc = path.join(root, 'etc', 'apt');
-  fs.mkdirSync(bin, { recursive: true });
-  fs.mkdirSync(state, { recursive: true });
-  fs.mkdirSync(path.join(aptEtc, 'sources.list.d'), { recursive: true });
-  fs.writeFileSync(path.join(state, 'candidate'), candInitial);
-  if (preexistingNodesourceList !== undefined) {
-    fs.writeFileSync(path.join(aptEtc, 'sources.list.d', 'nodesource.list'), preexistingNodesourceList);
-  }
-
-  const stub = (name, body) => {
-    const p = path.join(bin, name);
-    fs.writeFileSync(p, `#!/usr/bin/env bash\n${body}\n`, { mode: 0o755 });
-  };
-
-  // Force the non-root path so every mutation goes through the sudo stub.
-  stub('id', 'echo 1000');
-  stub('sudo', 'exec "$@"');
-  stub('curl', 'echo "FAKE-KEY"');
-  stub('stoke', 'echo 1.2.0');
-  stub('apt-cache', [
-    'cand="$(cat "$STATE_DIR/candidate")"',
-    '[ "$cand" = "absent" ] && exit 0',
-    'label="Candidato"',
-    '[ "${LC_ALL:-}" = "C" ] && label="Candidate"',
-    'printf "nodejs:\\n  Installed: (none)\\n  %s: %s\\n" "$label" "$cand"',
-  ].join('\n'));
-  stub('apt-get', [
-    'echo "apt-get $*" >> "$STATE_DIR/apt-get.log"',
-    'for a in "$@"; do',
-    '  if [ "$a" = update ]; then',
-    '    if [ -e "$STOKE_APT_ETC/sources.list.d/nodesource.list" ] && [ -n "${CAND_AFTER_NODESOURCE:-}" ]; then',
-    '      echo "$CAND_AFTER_NODESOURCE" > "$STATE_DIR/candidate"',
-    '    elif [ -n "${CAND_AFTER_UPDATE:-}" ]; then',
-    '      echo "$CAND_AFTER_UPDATE" > "$STATE_DIR/candidate"',
-    '    fi',
-    '  fi',
-    'done',
-    'exit 0',
-  ].join('\n'));
-
-  const res = spawnSync('bash', [SCRIPT], {
-    encoding: 'utf8',
-    env: {
-      ...process.env,
-      PATH: `${bin}:${process.env.PATH}`,
-      STOKE_APT_ETC: aptEtc,
-      STATE_DIR: state,
-      CAND_AFTER_UPDATE: candAfterUpdate || '',
-      CAND_AFTER_NODESOURCE: candAfterNodesource || '',
-      LC_ALL: 'es_ES.UTF-8', // localized environment; the script must force C
-    },
-  });
-
-  const read = (p) => (fs.existsSync(p) ? fs.readFileSync(p, 'utf8') : null);
-  const result = {
-    res,
-    aptEtc,
-    nodesourceList: read(path.join(aptEtc, 'sources.list.d', 'nodesource.list')),
-    nodesourceKey: read(path.join(aptEtc, 'keyrings', 'nodesource.asc')),
-    aptGetLog: read(path.join(state, 'apt-get.log')) || '',
-  };
-  // Drop the throwaway tree after we have read everything we need.
-  fs.rmSync(root, { recursive: true, force: true });
-  return result;
-}
-
-test('suitable nodejs candidate already available: installs without touching NodeSource', () => {
-  // Epoch-prefixed version also covers the epoch-stripping in the comparison.
-  const s = runScenario({ candInitial: '1:22.23.1-1nodesource1' });
-  assert.equal(s.res.status, 0, s.res.stderr);
-  assert.equal(s.nodesourceList, null);
-  assert.match(s.aptGetLog, /install -y stoke/);
-});
-
-test('no cached metadata: refreshes apt lists before deciding, no NodeSource needed', () => {
-  const s = runScenario({ candInitial: 'absent', candAfterUpdate: '22.23.1-1nodesource1' });
-  assert.equal(s.res.status, 0, s.res.stderr);
-  assert.equal(s.nodesourceList, null);
-  assert.match(s.aptGetLog, /install -y stoke/);
-});
-
-test('distro nodejs too old: bootstraps NodeSource and installs', () => {
-  const s = runScenario({
-    candInitial: '20.19.2+dfsg-1+deb13u2',
-    candAfterUpdate: '20.19.2+dfsg-1+deb13u2',
-    candAfterNodesource: '22.23.1-1nodesource1',
-  });
-  assert.equal(s.res.status, 0, s.res.stderr);
-  assert.match(s.nodesourceList, /deb \[signed-by=.*nodesource\.asc\] https:\/\/deb\.nodesource\.com\/node_22\.x nodistro main/);
-  assert.equal(s.nodesourceKey, 'FAKE-KEY\n');
-  assert.match(s.aptGetLog, /install -y stoke/);
-});
-
-test('bootstrap failure: NodeSource still lacks a suitable nodejs, exits with error', () => {
-  const s = runScenario({
-    candInitial: '20.19.2+dfsg-1+deb13u2',
-    candAfterUpdate: '20.19.2+dfsg-1+deb13u2',
-    candAfterNodesource: '20.19.2+dfsg-1+deb13u2',
-  });
-  assert.notEqual(s.res.status, 0);
-  assert.match(s.res.stderr, /still no nodejs >= 22\.12/);
-  assert.doesNotMatch(s.aptGetLog, /install -y stoke/);
-});
-
-test('pre-existing user-managed nodesource.list is never overwritten', () => {
-  const marker = '# user-managed entry\n';
-  const s = runScenario({
-    candInitial: '18.19.1+dfsg-6ubuntu5',
-    candAfterUpdate: '18.19.1+dfsg-6ubuntu5',
-    preexistingNodesourceList: marker,
-  });
-  assert.notEqual(s.res.status, 0);
-  assert.match(s.res.stderr, /refusing to overwrite/);
-  assert.equal(s.nodesourceList, marker);
-  assert.doesNotMatch(s.aptGetLog, /install -y stoke/);
-});