@bongos/core 1.17.0

package/tests/box_connect_e2e.mjs

@@ -0,0 +1,196 @@
+// tests/box_connect_e2e.mjs
+//
+// END-TO-END smoke for the builder bootstrap (#685, ADR 0031 §1): runs the REAL
+// infra/box-connect.sh against a local stub server and asserts the whole flow.
+// NO production, NO Postgres, NO GitHub, NO real box — but the genuine shell
+// script, the genuine box router handlers (POST /box/ssh-key, GET
+// /box/managed-settings), and a stubbed device-flow.
+//
+// What it proves a real builder's `curl … | bash` would do:
+//   1. generates an SSH key at OTB_SSH_KEY (private half stays local),
+//   2. device-flow signs in and registers the PUBLIC key — and the fingerprint
+//      the server computes matches the key on disk,
+//   3. downloads + installs managed-settings.json at the install dir,
+//   4. exits 0.
+//
+// Hermetic + deterministic (the device-flow poll returns 'ok' immediately; a
+// PATH shim no-ops `open`/`xdg-open` so no browser pops). Requires bash, curl,
+// ssh-keygen — present on macOS and the CI ubuntu runner.
+//
+// Run:  node tests/box_connect_e2e.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import http from 'node:http';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { spawn } from 'node:child_process';
+
+const require = createRequire(import.meta.url);
+const express = require('express');
+const auth = require('../src/bongos/auth.js');
+const o = require('../modules/dev-box/box-onboard.js');
+const gdsDb = require('../src/bongos/db.js');
+const boxes = require('../modules/dev-box/boxes.js');
+const boxAccess = require('../modules/dev-box/box-access.js');
+
+// Async spawn helper: run a real shell script against the in-process stub server
+// without blocking the event loop (spawnSync would deadlock the HTTP server).
+function runScript(scriptArgs, extraEnv) {
+  return new Promise((resolve) => {
+    const child = spawn('bash', scriptArgs, { env: { ...process.env, ...extraEnv } });
+    let stdout = '';
+    let stderr = '';
+    child.stdout.on('data', (d) => { stdout += d; });
+    child.stderr.on('data', (d) => { stderr += d; });
+    const killer = setTimeout(() => child.kill('SIGKILL'), 60000);
+    child.on('close', (status) => { clearTimeout(killer); resolve({ status, stdout, stderr }); });
+  });
+}
+
+let passed = 0;
+let failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+// ── stub the trust boundary + the DB write the connect flow hits ────────────
+let registered = null;
+let CURRENT_DB_BUILDER = { rank: 'metic', status: 'active' };  // flipped to test the clawback
+auth.requireBuilder = (req, _res, next) => { req.builder = { id: 1, github_login: 'e2etester', rank: 'metic' }; next(); };
+auth.requireRank = () => (_req, _res, next) => next();
+o.registerSshKey = async (_db, _id, k) => { registered = k; return { id: 1, key_type: k.keyType, fingerprint: k.fingerprint, label: k.label }; };
+// Stubs for the GET /box/authorized-keys path (box-side sync test below).
+gdsDb.getBuilderById = async () => CURRENT_DB_BUILDER;
+boxes.getBoxByBuilderId = async () => ({ id: 1, builder_id: 1, state: 'active', scope: 'full' });
+boxAccess.recordSourceEvent = async () => {};
+o.listSshKeys = async () => ([{ public_key: 'ssh-ed25519 BUILDERKEYAAA', label: 'laptop' }]);
+o.touchSshKeysUsed = async () => {};
+
+const buildBoxRouter = require('../modules/dev-box/routes/box.js');
+const app = express();
+app.use(express.json());
+// Stub device-flow: start hands back a code, poll immediately approves.
+app.post('/api/gds/auth/device/start', (_req, res) =>
+  res.json({ device_code: 'dc-e2e', user_code: 'WXYZ-1234', verification_uri: 'http://127.0.0.1:9/device', interval: 1, expires_in: 30 }));
+app.post('/api/gds/auth/device/poll', (_req, res) => res.json({ state: 'ok', token: 'e2e-token' }));
+app.use('/api/gds', buildBoxRouter());
+
+const server = http.createServer(app);
+await new Promise((r) => server.listen(0, r));
+const port = server.address().port;
+
+// ── run the REAL bootstrap with test overrides ──────────────────────────────
+const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'otb-e2e-'));
+const keyPath = path.join(tmp, 'otb_builder');
+const settingsDir = path.join(tmp, 'claude');
+// PATH shim so the script's best-effort `open <url>` doesn't launch a browser.
+const shimDir = path.join(tmp, 'bin');
+fs.mkdirSync(shimDir);
+for (const cmd of ['open', 'xdg-open']) {
+  fs.writeFileSync(path.join(shimDir, cmd), '#!/bin/sh\nexit 0\n', { mode: 0o755 });
+}
+
+// Async spawn (NOT spawnSync): the stub server runs in THIS process's event
+// loop, so a synchronous spawn would block it and the child's HTTP calls would
+// hang. spawn + await-on-close keeps the loop free to answer the bootstrap.
+const run = await new Promise((resolve) => {
+  const child = spawn('bash', ['infra/box-connect.sh'], {
+    env: {
+      ...process.env,
+      PATH: `${shimDir}:${process.env.PATH}`,
+      GDS_API_BASE: `http://127.0.0.1:${port}`,
+      OTB_SSH_KEY: keyPath,
+      OTB_MANAGED_SETTINGS_DIR: settingsDir,
+    },
+  });
+  let stdout = '';
+  let stderr = '';
+  child.stdout.on('data', (d) => { stdout += d; });
+  child.stderr.on('data', (d) => { stderr += d; });
+  const killer = setTimeout(() => child.kill('SIGKILL'), 60000);
+  child.on('close', (status) => { clearTimeout(killer); resolve({ status, stdout, stderr }); });
+});
+
+console.log('box-connect.sh end-to-end (real script, stub server):');
+
+t('exits 0', () => {
+  assert.equal(run.status, 0, `non-zero exit. stdout:\n${run.stdout}\nstderr:\n${run.stderr}`);
+});
+
+t('generated an SSH keypair at OTB_SSH_KEY (private + public)', () => {
+  assert.ok(fs.existsSync(keyPath), 'private key missing');
+  assert.ok(fs.existsSync(`${keyPath}.pub`), 'public key missing');
+});
+
+t('registered the public key, and the server-computed fingerprint matches the key on disk', () => {
+  assert.ok(registered, 'registerSshKey was never called');
+  const pub = fs.readFileSync(`${keyPath}.pub`, 'utf8');
+  const expected = o.validateSshPublicKey(pub);
+  assert.equal(registered.fingerprint, expected.fingerprint, 'fingerprint mismatch');
+  // The script trims the comment before sending; stored normalized = "<type> <base64>".
+  assert.equal(registered.publicKey, expected.normalized);
+});
+
+t('installed managed-settings.json at the override dir, keyed off the session login', () => {
+  const f = path.join(settingsDir, 'managed-settings.json');
+  assert.ok(fs.existsSync(f), 'managed-settings.json not written');
+  const s = JSON.parse(fs.readFileSync(f, 'utf8'));
+  assert.equal(s.sshConfigs[0].sshHost, 'root@box-e2etester.dev.amazonprimea.com');
+  assert.deepEqual(s.sshHostAllowlist, ['*.dev.amazonprimea.com']);
+});
+
+t('did NOT leak the GDS token into stdout/stderr', () => {
+  assert.ok(!`${run.stdout}${run.stderr}`.includes('e2e-token'), 'token leaked to output');
+});
+
+// ── box-side: box-authorized-keys-fetch.sh against the real route ───────────
+console.log('\nbox-authorized-keys-fetch.sh end-to-end (real script, stub server):');
+
+const sessionFile = path.join(tmp, 'gds-session.json');
+fs.writeFileSync(sessionFile, JSON.stringify({ token: 'e2e-token' }));
+const akFile = path.join(tmp, 'authorized_keys');
+const OPERATOR_LINE = 'ssh-ed25519 OPERATORKEYZZZ operator@control-plane';
+fs.writeFileSync(akFile, OPERATOR_LINE + '\n');  // pre-seed operator key (must survive)
+
+const akEnv = {
+  GDS_BASE: `http://127.0.0.1:${port}/api/gds`,
+  GDS_SESSION: sessionFile,
+  AUTHORIZED_KEYS: akFile,
+};
+
+// Scenario A — active builder: managed block synced, operator key preserved.
+CURRENT_DB_BUILDER = { rank: 'metic', status: 'active' };
+const sync = await runScript(['infra/box-authorized-keys-fetch.sh'], akEnv);
+
+t('active builder: fetch exits 0', () => {
+  assert.equal(sync.status, 0, `stdout:\n${sync.stdout}\nstderr:\n${sync.stderr}`);
+});
+t('active builder: managed block holds the builder key AND the operator key survives', () => {
+  const ak = fs.readFileSync(akFile, 'utf8');
+  assert.ok(ak.includes('BUILDERKEYAAA'), 'builder key not synced');
+  assert.ok(ak.includes(OPERATOR_LINE), 'operator key clobbered');
+  assert.ok(ak.includes(o.MANAGED_BLOCK_BEGIN) && ak.includes(o.MANAGED_BLOCK_END), 'markers missing');
+});
+
+// Scenario B — deactivated builder: 403 clawback empties the block, operator stays.
+CURRENT_DB_BUILDER = { rank: 'metic', status: 'inactive' };
+const claw = await runScript(['infra/box-authorized-keys-fetch.sh'], akEnv);
+
+t('deactivated builder: fetch exits 3 (revoked)', () => {
+  assert.equal(claw.status, 3, `stdout:\n${claw.stdout}\nstderr:\n${claw.stderr}`);
+});
+t('deactivated builder: managed block emptied (login cut), operator key STILL present', () => {
+  const ak = fs.readFileSync(akFile, 'utf8');
+  assert.ok(!ak.includes('BUILDERKEYAAA'), 'builder key NOT revoked — still in authorized_keys!');
+  assert.ok(ak.includes(OPERATOR_LINE), 'operator key clobbered by the clawback');
+  assert.ok(ak.includes(o.MANAGED_BLOCK_BEGIN), 'managed block markers should remain (empty)');
+});
+
+await new Promise((r) => server.close(r));
+fs.rmSync(tmp, { recursive: true, force: true });
+
+console.log(`\nbox_connect_e2e.mjs: ${passed} passed, ${failed} failed`);
+process.exit(failed === 0 ? 0 : 1);

package/tests/box_cost.mjs

@@ -0,0 +1,70 @@
+// tests/box_cost.mjs — pure-function coverage for the container cost ledger
+// (#602): storageCostUsd (parked-interval cost) + summarizeBoxCost (bucket
+// cost_log rows into spinup/compute/storage/total). The DB writers
+// (recordSpinupCost/recordStorageCost) and the per-builder summary queries take a
+// `db` param and are exercised by the integration smoke, not here. No DB, no clock.
+//
+// Run:  node tests/box_cost.mjs   (also runs in the unit gate)
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const boxes = require('../modules/dev-box/boxes.js');
+
+let passed = 0, failed = 0;
+const t = (n, f) => { try { f(); passed++; console.log(`  PASS  ${n}`); } catch (e) { failed++; console.log(`  FAIL  ${n}\n        ${e.message}`); } };
+
+t('storageCostUsd: hours parked × snapshot hourly rate (monthly/730)', () => {
+  const hourly = boxes.SNAPSHOT_MONTHLY_USD / 730;
+  // 730h parked ≈ one month
+  const month = boxes.storageCostUsd({ parkedSinceMs: 0, untilMs: 730 * 3_600_000 });
+  assert.ok(Math.abs(month - boxes.SNAPSHOT_MONTHLY_USD) < 0.001, `~monthly: got ${month}`);
+  // 10h parked
+  const ten = boxes.storageCostUsd({ parkedSinceMs: 0, untilMs: 10 * 3_600_000 });
+  assert.ok(Math.abs(ten - hourly * 10) < 0.0001, `10h: got ${ten}`);
+});
+
+t('storageCostUsd: zero/negative/invalid interval → 0', () => {
+  assert.equal(boxes.storageCostUsd({ parkedSinceMs: 100, untilMs: 100 }), 0);
+  assert.equal(boxes.storageCostUsd({ parkedSinceMs: 200, untilMs: 100 }), 0);
+  assert.equal(boxes.storageCostUsd({}), 0);
+  assert.equal(boxes.storageCostUsd({ parkedSinceMs: NaN, untilMs: 1 }), 0);
+});
+
+t('summarizeBoxCost: buckets by source into spinup/compute/storage + total', () => {
+  const rows = [
+    { source: 'box-spinup', amount_usd: 0 },
+    { source: 'box-spinup', amount_usd: 0.02 },
+    { source: 'box-lifecycle', amount_usd: 1.50 },
+    { source: 'box-lifecycle', amount_usd: 0.25 },
+    { source: 'box-storage', amount_usd: 0.30 },
+  ];
+  const s = boxes.summarizeBoxCost(rows);
+  assert.equal(s.spinup_usd, 0.02);
+  assert.equal(s.compute_usd, 1.75);
+  assert.equal(s.storage_usd, 0.30);
+  assert.equal(s.total_usd, 2.07);
+});
+
+t('summarizeBoxCost: empty / null → all zeros', () => {
+  assert.deepEqual(boxes.summarizeBoxCost([]), { spinup_usd: 0, compute_usd: 0, storage_usd: 0, total_usd: 0 });
+  assert.deepEqual(boxes.summarizeBoxCost(null), { spinup_usd: 0, compute_usd: 0, storage_usd: 0, total_usd: 0 });
+});
+
+t('summarizeBoxCost: an unknown source still counts toward total (no silent drop)', () => {
+  const s = boxes.summarizeBoxCost([{ source: 'box-mystery', amount_usd: 0.5 }]);
+  assert.equal(s.total_usd, 0.5);
+  assert.equal(s.compute_usd, 0);
+});
+
+t('BOX_COST_SOURCES covers exactly the three box ledger sources', () => {
+  assert.deepEqual([...boxes.BOX_COST_SOURCES].sort(), ['box-lifecycle', 'box-spinup', 'box-storage']);
+});
+
+t('SPINUP_COST_USD defaults to 0 (DO charges no provision fee; the row is an event marker)', () => {
+  assert.equal(boxes.SPINUP_COST_USD, 0);
+});
+
+console.log(`\nbox_cost: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);

package/tests/box_dns_repoint.mjs

@@ -0,0 +1,151 @@
+// tests/box_dns_repoint.mjs
+//
+// Hermetic coverage for the box DNS-repoint reliability fix (task 1180 — the
+// @kingaonline "handshake timeout" outage: a transient Cloudflare auth blip on the
+// zone lookup left box-<login>.dev pinned at a dead IP while provision reported
+// success). NO network, NO Cloudflare, NO DB:
+//
+//   Part A — drives infra/box-dns-cloudflare.sh with a STUBBED `curl` on PATH to
+//     prove: (1) a transient first-attempt blip self-heals via retry; (2) a real CF
+//     auth error surfaces the REAL code (not the old misleading "zone not found");
+//     (3) a genuinely-missing zone still says so; (4) --delete is idempotent.
+//   Part B — imports scripts/gds/box.js and proves runDnsHook / runDnsHookBlackhole
+//     RETURN ok:false on failure (the "stop swallowing" contract) instead of
+//     silently continuing, AND that runDnsHookBlackhole REPOINTS the record to the
+//     non-routable sentinel 192.0.2.1 (idea 309) rather than deleting it.
+//
+// Run:  node tests/box_dns_repoint.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { spawnSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+const require = createRequire(import.meta.url);
+const here = path.dirname(fileURLToPath(import.meta.url));
+const repo = path.resolve(here, '..');
+const HOOK = path.join(repo, 'infra', 'box-dns-cloudflare.sh');
+
+// ── a fake `curl` that emulates the Cloudflare API per FAKE_CF_SCENARIO ─────────
+const FAKE_CURL = `#!/usr/bin/env node
+const fs = require('fs');
+const args = process.argv.slice(2);
+const url = args.find(a => a.startsWith('http')) || '';
+const mi = args.indexOf('-X');
+const method = mi >= 0 ? args[mi + 1] : 'GET';
+const scen = process.env.FAKE_CF_SCENARIO || '';
+const counter = process.env.FAKE_CF_COUNTER;
+function bump() { let n = 0; try { n = parseInt(fs.readFileSync(counter, 'utf8')) || 0; } catch (e) {} n++; fs.writeFileSync(counter, String(n)); return n; }
+const ok = (result) => JSON.stringify({ success: true, errors: [], result });
+const fail = (code, message) => JSON.stringify({ success: false, errors: [{ code, message }], result: null });
+let out = '';
+if (url.includes('/zones?name=')) {
+  if (scen === 'retry_zone') out = bump() === 1 ? '' : ok([{ id: 'ZONE123' }]);      // transient empty, then OK
+  else if (scen === 'auth_fail') out = fail(1000, 'Invalid API Token');               // persistent auth error
+  else if (scen === 'zone_missing') out = ok([]);                                      // success, no such zone
+  else out = ok([{ id: 'ZONE123' }]);
+} else if (url.includes('/dns_records?type=A')) {
+  out = (scen === 'delete_noop') ? ok([]) : ok([{ id: 'REC456' }]);
+} else if (method === 'PUT') out = ok({ id: 'REC456' });
+else if (method === 'POST') out = ok({ id: 'REC789' });
+else if (method === 'DELETE') out = ok({ id: 'REC456' });
+else out = ok([]);
+process.stdout.write(out);
+`;
+
+const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'otb-dns-'));
+const curlPath = path.join(tmp, 'curl');
+fs.writeFileSync(curlPath, FAKE_CURL, { mode: 0o755 });
+const counterFile = path.join(tmp, 'counter');
+
+function runHook(scenario, extraEnv = {}, retries = '4') {
+  fs.writeFileSync(counterFile, '0');
+  const res = spawnSync('bash', [HOOK], {
+    encoding: 'utf8',
+    env: {
+      ...process.env,
+      PATH: `${tmp}:${process.env.PATH}`,
+      CLOUDFLARE_API_TOKEN: 'faketoken',
+      CLOUDFLARE_ZONE: 'amazonprimea.com',
+      BOX_HOSTNAME: 'box-test.dev.amazonprimea.com',
+      BOX_DNS_BACKOFF_BASE: '0', // no real sleeps in tests
+      BOX_DNS_RETRIES: retries,
+      FAKE_CF_SCENARIO: scenario,
+      FAKE_CF_COUNTER: counterFile,
+      ...extraEnv,
+    },
+  });
+  return { status: res.status, out: `${res.stdout || ''}${res.stderr || ''}` };
+}
+
+// 1) transient blip on the FIRST zone lookup self-heals via retry → success
+{
+  const r = runHook('retry_zone', { BOX_IP: '1.2.3.4' });
+  assert.equal(r.status, 0, `retry should self-heal to exit 0; got ${r.status} :: ${r.out}`);
+  assert.match(r.out, /updated A box-test\.dev\.amazonprimea\.com -> 1\.2\.3\.4/, r.out);
+  const attempts = parseInt(fs.readFileSync(counterFile, 'utf8'));
+  assert.ok(attempts >= 2, `zone lookup should have been retried (>=2 attempts), got ${attempts}`);
+}
+
+// 2) a REAL Cloudflare auth error surfaces the real code, NOT the old misleading text
+{
+  const r = runHook('auth_fail', { BOX_IP: '1.2.3.4' }, '2');
+  assert.notEqual(r.status, 0, 'persistent auth failure must exit non-zero');
+  assert.match(r.out, /1000/, `should surface the real CF error code 1000 :: ${r.out}`);
+  assert.doesNotMatch(r.out, /genuinely not found/, `auth error must NOT be reported as a missing zone :: ${r.out}`);
+}
+
+// 3) a genuinely-missing zone (success + empty result) is still reported as such
+{
+  const r = runHook('zone_missing', { BOX_IP: '1.2.3.4' });
+  assert.notEqual(r.status, 0, 'missing zone must exit non-zero');
+  assert.match(r.out, /genuinely not found/, r.out);
+}
+
+// 4) delete mode is idempotent: no-op when the record is absent, deletes when present
+{
+  const noop = runHook('delete_noop', { BOX_DNS_DELETE: '1' });
+  assert.equal(noop.status, 0, `delete of an absent record is a no-op (exit 0); got ${noop.status} :: ${noop.out}`);
+  assert.match(noop.out, /nothing to delete/, noop.out);
+
+  const hit = runHook('delete_hit', { BOX_DNS_DELETE: '1' });
+  assert.equal(hit.status, 0, `delete of a present record exits 0; got ${hit.status} :: ${hit.out}`);
+  assert.match(hit.out, /deleted A box-test\.dev\.amazonprimea\.com/, hit.out);
+}
+
+// ── Part B: runDnsHook / runDnsHookBlackhole contract + the idea-309 repoint ────
+{
+  const box = require('../scripts/gds/box.js');
+  const upOk = box.runDnsHook('box-x.dev.amazonprimea.com', '1.2.3.4', 'exit 0');
+  assert.equal(upOk.ok, true, 'runDnsHook returns ok:true when the hook succeeds');
+
+  const upFail = box.runDnsHook('box-x.dev.amazonprimea.com', '1.2.3.4', 'exit 1');
+  assert.equal(upFail.ok, false, 'runDnsHook returns ok:false when the hook FAILS (no silent swallow)');
+
+  const noIp = box.runDnsHook('box-x.dev.amazonprimea.com', null, 'exit 1');
+  assert.equal(noIp.ok, true, 'runDnsHook is a no-op (ok:true skipped) when ip is absent');
+
+  // idea 309: on deprovision the box lifecycle REPOINTS the record to the
+  // non-routable sentinel 192.0.2.1 (never deletes) — so a reap→rebuild can't open
+  // an NXDOMAIN window. Drive runDnsHookBlackhole with a hook that captures the
+  // BOX_IP it is handed, and assert it is the sentinel via the upsert path.
+  const probe = path.join(tmp, 'blackhole-ip');
+  process.env.PROBE_FILE = probe;
+  const captureHook = `node -e 'require("fs").writeFileSync(process.env.PROBE_FILE, process.env.BOX_IP || "MISSING")'`;
+  const bhOk = box.runDnsHookBlackhole('box-x.dev.amazonprimea.com', captureHook);
+  assert.equal(bhOk.ok, true, 'runDnsHookBlackhole returns ok:true when the hook succeeds');
+  assert.equal(fs.readFileSync(probe, 'utf8'), '192.0.2.1', 'runDnsHookBlackhole must REPOINT to the 192.0.2.1 sentinel (not delete)');
+  delete process.env.PROBE_FILE;
+
+  const bhFail = box.runDnsHookBlackhole('box-x.dev.amazonprimea.com', 'exit 1');
+  assert.equal(bhFail.ok, false, 'runDnsHookBlackhole returns ok:false when the hook FAILS (best-effort, but still reports)');
+
+  const bhNoHook = box.runDnsHookBlackhole('box-x.dev.amazonprimea.com', null);
+  assert.equal(bhNoHook.ok, true, 'runDnsHookBlackhole is a no-op (ok:true skipped) when no hook is configured');
+}
+
+fs.rmSync(tmp, { recursive: true, force: true });
+console.log('box_dns_repoint: all assertions passed');

package/tests/box_host_keys.mjs

@@ -0,0 +1,102 @@
+// tests/box_host_keys.mjs
+//
+// Hermetic unit test for box-onboard.validateHostKeyLines (task 1187 / idea 235) —
+// the pure validator that gates what a box may report as its SSH host keys before
+// the GDS stores them and the connect path writes them into known_hosts. NO DB, NO
+// network. Fixtures are REAL ssh public keys (the validator decodes the blob).
+//
+// Run:  node tests/box_host_keys.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const { validateHostKeyLines, MAX_HOST_KEY_LINES } = require('../modules/dev-box/box-onboard.js');
+
+// Real public keys (type + base64, comment dropped) — generated with ssh-keygen.
+const ED = 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPCoIEgcBiGqM2Rd0rgfw0d7rHccvbpSe3vsSN7brif/';
+const EC = 'ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBGWPW+MhwAnlUVCs+QxvXoX0zdpSN3JCJGZ8AaffThbwJQ2CLMtRRkxiQqO/alJ1nj4Yc2SbXhB6E+RZXkllkvs=';
+const RSA = 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC/FqVQUVRAmcDHRBeEZZwuW0xgsAPTm1NpPlYlY4rVF2W8llM0AKXlfqYoXmKUvCmuhTUo+d/0mRbMXS8rcDyDB2zZbLNL7wSMqsL0EW0xw+GFVDARInwhnKGhPS1fbSYSS+FYlBtacPmFByO3Tw5hloqKViKTJkbMPT/ZFhyhcvFAu5ssEyMM4f5AXGFEaZ8tjzZKEAvr3LXR+X5/sknUP4YgwjJI/sOToorisjOsG9nnNs5mbhFiwQORlCmYuKuGmJuBxbCufva+9mMYPgVLS3IMavdra+31OyFUGZRAFPSDODIow1LWfQoq/bcFLt9/US+A2TeloBNc7QB2hIGn';
+
+// 1) clean multi-type report → accepted, normalized, all three lines preserved
+{
+  const r = validateHostKeyLines([ED, EC, RSA].join('\n'));
+  assert.equal(r.ok, true, `clean report should pass: ${JSON.stringify(r)}`);
+  assert.equal(r.lines.length, 3);
+  assert.deepEqual(r.lines, [ED, EC, RSA], 'normalized to `<type> <base64>`, order preserved');
+}
+
+// 1b) trailing newline / blank lines are tolerated (a .pub file has a trailing \n)
+{
+  const r = validateHostKeyLines(`${ED}\n\n${RSA}\n`);
+  assert.equal(r.ok, true, JSON.stringify(r));
+  assert.equal(r.lines.length, 2);
+}
+
+// 2) ed25519 alone is enough
+{
+  assert.equal(validateHostKeyLines(ED).ok, true);
+}
+
+// 3) NO ed25519 line → rejected (the 925/926 'green but Host denied' failure)
+{
+  const r = validateHostKeyLines([EC, RSA].join('\n'));
+  assert.equal(r.ok, false);
+  assert.equal(r.error, 'missing_ed25519');
+}
+
+// 4) a hostname prefix (3 fields) → refused, not silently trimmed
+{
+  const r = validateHostKeyLines(`box-x.dev.amazonprimea.com ${ED}`);
+  assert.equal(r.ok, false);
+  assert.equal(r.error, 'expect_type_and_key_only');
+}
+
+// 4b) a trailing comment / extra field → also refused
+{
+  const r = validateHostKeyLines(`${ED} root@box`);
+  assert.equal(r.ok, false);
+  assert.equal(r.error, 'expect_type_and_key_only');
+}
+
+// 5) a control char inside a line → rejected (injection guard)
+{
+  const r = validateHostKeyLines(`ssh-ed25519 AAAA\x07BBBB`);
+  assert.equal(r.ok, false, 'control char must be rejected');
+}
+
+// 6) too many lines → capped
+{
+  const many = Array.from({ length: MAX_HOST_KEY_LINES + 1 }, () => ED).join('\n');
+  const r = validateHostKeyLines(many);
+  assert.equal(r.ok, false);
+  assert.equal(r.error, 'too_many_lines');
+}
+
+// 7) bad base64 → rejected
+{
+  const r = validateHostKeyLines('ssh-ed25519 not-valid-base64!!!');
+  assert.equal(r.ok, false);
+}
+
+// 8) unknown key type → rejected
+{
+  const r = validateHostKeyLines(`ssh-frobnicate ${ED.split(' ')[1]}`);
+  assert.equal(r.ok, false);
+}
+
+// 9) empty / whitespace → rejected
+{
+  assert.equal(validateHostKeyLines('').ok, false);
+  assert.equal(validateHostKeyLines('   \n  ').ok, false);
+  assert.equal(validateHostKeyLines(42).ok, false);
+}
+
+// 10) a bare key type with no body (1 field) → refused
+{
+  const r = validateHostKeyLines('ssh-ed25519');
+  assert.equal(r.ok, false);
+  assert.equal(r.error, 'expect_type_and_key_only');
+}
+
+console.log('box_host_keys: all assertions passed');