@bongos/core 1.17.0

package/tests/box_onboard.mjs

@@ -0,0 +1,317 @@
+// tests/box_onboard.mjs
+//
+// Hermetic unit smoke for the one-command onboarding module
+// (modules/dev-box/box-onboard.js, ADR 0031 §1/§6, #685). Covers the PURE core — SSH
+// public-key validation + fingerprinting, the injection-rejection that protects
+// authorized_keys, the managed-block + managed-settings + connect-guide
+// renderers — and the DB query SHAPES via a fake pool. NO database, NO network,
+// NO real box. The live-rank GATE for /box/authorized-keys reuses
+// box-access.decideSourceAccess, which is pinned in scripts/gds/smoke-box.sh.
+//
+// Run:  node tests/box_onboard.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import http from 'node:http';
+
+const require = createRequire(import.meta.url);
+const o = require('../modules/dev-box/box-onboard.js');
+
+let passed = 0;
+let failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+async function ta(name, fn) {
+  try { await fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+// A throwaway ed25519 public key + the SHA256 fingerprint `ssh-keygen -lf`
+// prints for it (verified against ssh-keygen during development). Public keys
+// are non-secret; this one's matching private half was discarded.
+const FIXTURE_PUB = 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOsaRCiI/mJIQy+FFxmIudxnSYYI6spAHH3DFkab4MVU otb@fixture';
+const FIXTURE_FP = 'SHA256:LOQ37km6nDckWk1R6EzLqObe4bKdFCe8vY4VFHy+eBY';
+
+// Minimal fake pg pool: returns queued results in order, records every call.
+function fakeDb(results) {
+  const calls = [];
+  return {
+    calls,
+    async query(sql, params) {
+      calls.push({ sql, params });
+      return results.shift() || { rows: [] };
+    },
+  };
+}
+
+console.log('validateSshPublicKey — accept:');
+
+t('valid ed25519 → ok, type, fingerprint matches ssh-keygen, comment dropped from normalized', () => {
+  const r = o.validateSshPublicKey(FIXTURE_PUB);
+  assert.equal(r.ok, true);
+  assert.equal(r.keyType, 'ssh-ed25519');
+  assert.equal(r.fingerprint, FIXTURE_FP);
+  // normalized is exactly `<type> <base64>` — the user comment is NOT carried in.
+  assert.equal(r.normalized, 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOsaRCiI/mJIQy+FFxmIudxnSYYI6spAHH3DFkab4MVU');
+  assert.equal(r.label, 'otb@fixture');
+});
+
+t('trailing newline (a .pub file) is tolerated', () => {
+  assert.equal(o.validateSshPublicKey(FIXTURE_PUB + '\n').ok, true);
+});
+
+console.log('validateSshPublicKey — reject (the authorized_keys injection surface):');
+
+t('embedded newline → multiline_or_control', () => {
+  assert.equal(o.validateSshPublicKey('ssh-ed25519 AAAA\ncommand="x" ssh-ed25519 BBBB').error, 'multiline_or_control');
+});
+t('a command="" options PREFIX is refused (line must START with a key type)', () => {
+  assert.equal(o.validateSshPublicKey('command="rm -rf /" ssh-ed25519 AAAAC3').error, 'unsupported_type');
+});
+t('unsupported key type → unsupported_type', () => {
+  assert.equal(o.validateSshPublicKey('ssh-dss AAAAB3').error, 'unsupported_type');
+});
+t('non-base64 body → bad_base64', () => {
+  assert.equal(o.validateSshPublicKey('ssh-ed25519 not-base64!!!').error, 'bad_base64');
+});
+t('valid base64 that is NOT an ssh key → bad_key_blob / type_mismatch', () => {
+  const r = o.validateSshPublicKey('ssh-ed25519 ' + Buffer.from('hello world').toString('base64'));
+  assert.equal(r.ok, false);
+  assert.ok(r.error === 'bad_key_blob' || r.error === 'type_mismatch');
+});
+t('empty / non-string → rejected', () => {
+  assert.equal(o.validateSshPublicKey('').error, 'empty');
+  assert.equal(o.validateSshPublicKey(null).error, 'not_a_string');
+  assert.equal(o.validateSshPublicKey(42).error, 'not_a_string');
+});
+
+console.log('sanitizeLabel:');
+
+t('strips quotes/control, collapses, caps length; null on empty', () => {
+  assert.equal(o.sanitizeLabel('laptop "evil"\nrm'), 'laptop evil rm');
+  assert.equal(o.sanitizeLabel('   '), null);
+  assert.equal(o.sanitizeLabel('#$%^&*'), null);          // no allowed chars → null
+  assert.equal(o.sanitizeLabel('@'), '@');                // @ IS an allowed label char
+  assert.equal(o.sanitizeLabel('x'.repeat(200)).length, 64);
+  assert.equal(o.sanitizeLabel(undefined), null);
+});
+
+console.log('authorized_keys rendering:');
+
+t('buildAuthorizedKeysFile: one line per key, trailing newline, empty set → empty string', () => {
+  assert.equal(o.buildAuthorizedKeysFile([]), '');
+  const f = o.buildAuthorizedKeysFile([
+    { public_key: 'ssh-ed25519 AAAA', label: 'laptop' },
+    { public_key: 'ssh-ed25519 BBBB', label: null },
+  ]);
+  assert.equal(f, 'ssh-ed25519 AAAA laptop\nssh-ed25519 BBBB\n');
+});
+
+t('buildAuthorizedKeysLines: a malicious DB label is re-sanitized (defense in depth)', () => {
+  // Even if a label with a newline somehow reached the DB, the renderer strips
+  // it — no second authorized_keys line can be smuggled via the comment.
+  const lines = o.buildAuthorizedKeysLines([{ public_key: 'ssh-ed25519 AAAA', label: 'ok\nssh-ed25519 EVIL' }]);
+  assert.equal(lines.length, 1);
+  assert.ok(!lines[0].includes('\n'));
+  assert.ok(lines[0].startsWith('ssh-ed25519 AAAA '));
+});
+
+t('wrapManagedBlock: markers present; empty keys → empty block (the clawback shape)', () => {
+  const empty = o.wrapManagedBlock([]);
+  assert.ok(empty.includes(o.MANAGED_BLOCK_BEGIN) && empty.includes(o.MANAGED_BLOCK_END));
+  assert.ok(!empty.includes('ssh-'));
+  const one = o.wrapManagedBlock([{ public_key: 'ssh-ed25519 AAAA', label: 'l' }]);
+  assert.match(one, /otb-managed[\s\S]*ssh-ed25519 AAAA l[\s\S]*<<< otb-managed/);
+});
+
+console.log('managed-settings:');
+
+t('buildManagedSettings: shape matches the template; allowlist pins the passed sshZone', () => {
+  // world + sshZone are supplied by the caller from the branding pack (task 1705);
+  // the renderer is pure and bakes exactly what it's given.
+  const s = o.buildManagedSettings({ login: 'alice', hostname: 'box-alice.dev.amazonprimea.com', world: 'Amazonprimea', sshZone: 'dev.amazonprimea.com' });
+  assert.equal(s.sshConfigs[0].id, 'otb-alice');
+  assert.equal(s.sshConfigs[0].name, 'Amazonprimea Dev Box');
+  assert.equal(s.sshConfigs[0].sshHost, 'root@box-alice.dev.amazonprimea.com');
+  assert.equal(s.sshConfigs[0].startDirectory, '~/workspace');
+  assert.deepEqual(s.sshHostAllowlist, ['*.dev.amazonprimea.com']);
+});
+
+t('buildManagedSettings: bad login / hostname throw coded errors (no injection into the JSON)', () => {
+  assert.throws(() => o.buildManagedSettings({ login: 'a/b', hostname: 'x.dev.amazonprimea.com' }), /BAD_LOGIN|invalid login/);
+  assert.throws(() => o.buildManagedSettings({ login: 'alice', hostname: 'evil"\nhost' }), /BAD_HOSTNAME|invalid hostname/);
+});
+
+console.log('connect guide:');
+
+t('renderConnectGuide: bakes the apiBase into the bootstrap URLs', () => {
+  const g = o.renderConnectGuide({ apiBase: 'https://staging.amazonprimea.com' });
+  assert.ok(g.includes('https://staging.amazonprimea.com/api/gds/box/connect.sh'));
+  assert.ok(g.includes('/api/gds/box/connect.ps1'));
+  // the supplied apiBase is baked verbatim (the caller PINS the origin — it is never
+  // a hardcoded host brand, task 1705)
+  assert.ok(o.renderConnectGuide({ apiBase: 'https://amazonprimea.com' }).includes('https://amazonprimea.com/api/gds/box/connect.sh'));
+});
+
+console.log('DB query shapes (fake pool):');
+
+await ta('registerSshKey: upserts ON CONFLICT (builder_id, fingerprint)', async () => {
+  const db = fakeDb([{ rows: [{ id: 7, key_type: 'ssh-ed25519', fingerprint: FIXTURE_FP, label: 'l' }] }]);
+  const row = await o.registerSshKey(db, 3, { publicKey: 'ssh-ed25519 AAAA', keyType: 'ssh-ed25519', fingerprint: FIXTURE_FP, label: 'l' });
+  assert.equal(row.id, 7);
+  assert.match(db.calls[0].sql, /INSERT INTO builder_ssh_keys/);
+  assert.match(db.calls[0].sql, /ON CONFLICT \(builder_id, fingerprint\)/);
+  assert.deepEqual(db.calls[0].params, [3, 'ssh-ed25519 AAAA', 'ssh-ed25519', FIXTURE_FP, 'l']);
+});
+
+await ta('deleteSshKey: scoped by builder_id (cannot delete another builder\'s key)', async () => {
+  const db = fakeDb([{ rows: [{ id: 9 }] }]);
+  const id = await o.deleteSshKey(db, 3, 9);
+  assert.equal(id, 9);
+  assert.match(db.calls[0].sql, /DELETE FROM builder_ssh_keys WHERE id = \$1 AND builder_id = \$2/);
+  assert.deepEqual(db.calls[0].params, [9, 3]);
+});
+
+await ta('deleteSshKey: returns null when nothing matched', async () => {
+  const db = fakeDb([{ rows: [] }]);
+  assert.equal(await o.deleteSshKey(db, 3, 999), null);
+});
+
+await ta('listSshKeys: selects the builder\'s keys', async () => {
+  const db = fakeDb([{ rows: [{ id: 1 }, { id: 2 }] }]);
+  const rows = await o.listSshKeys(db, 5);
+  assert.equal(rows.length, 2);
+  assert.match(db.calls[0].sql, /FROM builder_ssh_keys\s+WHERE builder_id = \$1/);
+  assert.deepEqual(db.calls[0].params, [5]);
+});
+
+// ===========================================================================
+// Layer 2 — REAL in-process HTTP through the actual box router (no DB).
+//
+// Same "stub the dependency module" pattern as tests/memory_isolation.mjs:
+// monkeypatch auth.requireBuilder BEFORE building the router (middleware is
+// captured at build time), stub the DB-touching box-onboard / db / boxes /
+// box-access functions (called by property at request time) so no Postgres is
+// needed, keep the PURE renderers + decideSourceAccess REAL, then fire real
+// requests. This exercises status codes, content-types, body parsing, and the
+// live-rank gate end-to-end through the genuine Express handlers.
+// ===========================================================================
+
+console.log('\nHTTP (real router, stubbed DB):');
+
+const express = require('express');
+const auth = require('../src/bongos/auth.js');
+const gdsDb = require('../src/bongos/db.js');
+const boxes = require('../modules/dev-box/boxes.js');
+const boxAccess = require('../modules/dev-box/box-access.js');
+
+// Mutable per-test fixtures.
+let CURRENT_SESSION = { id: 1, github_login: 'alice', rank: 'metic' };
+let CURRENT_DB_BUILDER = { rank: 'metic', status: 'active' };
+
+// Patch the auth middleware BEFORE building the router.
+auth.requireBuilder = (req, _res, next) => { req.builder = CURRENT_SESSION; next(); };
+auth.requireRank = () => (_req, _res, next) => next();
+
+// Stub the DB-touching functions (called by property → patching the cached
+// module object is enough). Pure renderers + decideSourceAccess stay real.
+gdsDb.getBuilderById = async () => CURRENT_DB_BUILDER;
+boxes.getBoxByBuilderId = async () => ({ id: 1, builder_id: 1, state: 'active', scope: 'full' });
+boxAccess.recordSourceEvent = async () => {};
+o.registerSshKey = async (_db, _id, k) => ({ id: 11, key_type: k.keyType, fingerprint: k.fingerprint, label: k.label });
+o.listSshKeys = async () => ([{ public_key: 'ssh-ed25519 AAAA', label: 'laptop' }]);
+o.touchSshKeysUsed = async () => {};
+
+// Pin the public origin BEFORE requiring the router (PUBLIC_ORIGIN is a
+// module-level const read at require time). This proves the served bootstrap
+// bakes the PINNED origin, not a spoofable request header (blocker #2/#5).
+process.env.GDS_PUBLIC_ORIGIN = 'https://pinned.example';
+const buildBoxRouter = require('../modules/dev-box/routes/box.js');
+const app = express();
+app.use(express.json());
+app.use('/api/gds', buildBoxRouter());
+
+const server = http.createServer(app);
+await new Promise((r) => server.listen(0, r));
+const base = `http://127.0.0.1:${server.address().port}`;
+const j = (path, opts) => fetch(`${base}${path}`, opts);
+
+await ta('POST /box/ssh-key: a valid key → 201 ok', async () => {
+  const r = await j('/api/gds/box/ssh-key', {
+    method: 'POST', headers: { 'content-type': 'application/json' },
+    body: JSON.stringify({ public_key: FIXTURE_PUB }),
+  });
+  assert.equal(r.status, 201);
+  const b = await r.json();
+  assert.equal(b.ok, true);
+  assert.equal(b.key.fingerprint, FIXTURE_FP);
+});
+
+await ta('POST /box/ssh-key: a bad key → 400 bad_ssh_key (rejected at the door)', async () => {
+  const r = await j('/api/gds/box/ssh-key', {
+    method: 'POST', headers: { 'content-type': 'application/json' },
+    body: JSON.stringify({ public_key: 'command="evil" ssh-ed25519 AAAA' }),
+  });
+  assert.equal(r.status, 400);
+  assert.equal((await r.json()).error, 'bad_ssh_key');
+});
+
+await ta('POST /box/ssh-key: a NEW key past the per-builder cap → 400 too_many_keys', async () => {
+  const saved = o.listSshKeys;
+  o.listSshKeys = async () => Array.from({ length: o.MAX_SSH_KEYS_PER_BUILDER },
+    (_, i) => ({ fingerprint: `SHA256:other${i}`, public_key: 'ssh-ed25519 X', label: null }));
+  try {
+    const r = await j('/api/gds/box/ssh-key', {
+      method: 'POST', headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ public_key: FIXTURE_PUB }),
+    });
+    assert.equal(r.status, 400);
+    const b = await r.json();
+    assert.equal(b.error, 'too_many_keys');
+    assert.equal(b.limit, o.MAX_SSH_KEYS_PER_BUILDER);
+  } finally {
+    o.listSshKeys = saved;
+  }
+});
+
+await ta('GET /box/authorized-keys: active builder → 200 text/plain with the managed lines', async () => {
+  CURRENT_DB_BUILDER = { rank: 'metic', status: 'active' };
+  const r = await j('/api/gds/box/authorized-keys');
+  assert.equal(r.status, 200);
+  assert.match(r.headers.get('content-type') || '', /text\/plain/);
+  assert.equal(await r.text(), 'ssh-ed25519 AAAA laptop\n');
+});
+
+await ta('GET /box/authorized-keys: deactivated builder → 403 BOX_ACCESS_REVOKED (login clawback)', async () => {
+  CURRENT_DB_BUILDER = { rank: 'metic', status: 'inactive' };
+  const r = await j('/api/gds/box/authorized-keys');
+  assert.equal(r.status, 403);
+  assert.equal((await r.json()).error, 'BOX_ACCESS_REVOKED');
+  CURRENT_DB_BUILDER = { rank: 'metic', status: 'active' };
+});
+
+await ta('GET /box/managed-settings: → 200 JSON keyed off the session login', async () => {
+  const r = await j('/api/gds/box/managed-settings');
+  assert.equal(r.status, 200);
+  const b = await r.json();
+  assert.equal(b.sshConfigs[0].id, 'otb-alice');
+  assert.equal(b.sshConfigs[0].sshHost, 'root@box-alice.dev.amazonprimea.com');
+});
+
+await ta('GET /box/connect.sh: PUBLIC, no auth → 200; bakes the PINNED origin and IGNORES a spoofed Host (blocker #2/#5)', async () => {
+  // Send a spoofed X-Forwarded-Host: a pre-fix server would reflect it into the
+  // script's GDS_API_BASE (token theft / RCE). The fix pins GDS_PUBLIC_ORIGIN.
+  const r = await j('/api/gds/box/connect.sh', { headers: { 'X-Forwarded-Host': 'evil.attacker.example' } });
+  assert.equal(r.status, 200);
+  const body = await r.text();
+  assert.ok(!body.includes('__GDS_API_BASE__'), 'placeholder must be substituted');
+  assert.ok(body.includes('https://pinned.example'), 'pinned GDS_PUBLIC_ORIGIN baked in');
+  assert.ok(!body.includes('evil.attacker.example'), 'a spoofed X-Forwarded-Host must NOT reach the served script');
+});
+
+await new Promise((r) => server.close(r));
+
+console.log(`\nbox_onboard.mjs: ${passed} passed, ${failed} failed`);
+process.exit(failed === 0 ? 0 : 1);

package/tests/box_scope_session.mjs

@@ -0,0 +1,115 @@
+// tests/box_scope_session.mjs
+//
+// SECURITY regression guard for #919 (security_reports SR#2): a dev-box session
+// (source='box') is DENY-BY-DEFAULT. The box provisioner bakes such a session into
+// cloud-init so the box can bootstrap (#818), but the token lives ON the box —
+// OUTSIDE the ADR 0016 trust boundary — so it must NOT carry the builder's full
+// authority. auth.requireBuilder rejects a 'box' session on every route EXCEPT the
+// handful the on-box crons need, which opt in via auth.allowBoxScope (a tiny
+// middleware mounted ahead of requireBuilder that sets req.allowBoxScope = true).
+//
+// The gate is fail-closed: a route WITHOUT allowBoxScope denies a box session, so
+// any route added later is denied to boxes automatically. cli/web sessions are
+// completely unaffected (the gate only fires when source === 'box').
+//
+// lookupSession is stubbed on the db module BEFORE auth.js is required, because
+// auth.js destructures it at load time. No server/DB/network.
+//
+// Run:  node tests/box_scope_session.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+
+const db = require('../src/bongos/db-kernel.js'); // lookupSession lives in db-kernel now (ADR 0102)
+let nextSession = null;
+db.lookupSession = async () => nextSession;
+const auth = require('../src/bongos/auth.js');
+
+const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
+function fakeRes() {
+  const res = {
+    _status: null, _json: null,
+    status(c) { this._status = c; return this; },
+    json(b) { this._json = b; return this; },
+  };
+  attachFail({}, res, () => {}); // install res.fail(), exactly as the router does (task 1991)
+  return res;
+}
+
+let pass = 0, fail = 0;
+const t = async (name, fn) => {
+  try { await fn(); pass++; console.log(`PASS  ${name}`); }
+  catch (e) { fail++; console.log(`FAIL  ${name}\n      ${e.stack || e.message}`); }
+};
+
+// ---- allowBoxScope middleware ------------------------------------------------
+await t('allowBoxScope sets req.allowBoxScope = true and calls next()', async () => {
+  const req = {};
+  let nexted = false;
+  auth.allowBoxScope(req, fakeRes(), () => { nexted = true; });
+  assert.equal(req.allowBoxScope, true);
+  assert.equal(nexted, true);
+});
+
+// ---- box session DENIED on a route that did NOT opt in -----------------------
+await t('box session on a non-box route → 403 box_scope, next() NOT called', async () => {
+  nextSession = { builder_id: 3, github_login: 'boxbot', rank: 'metic', status: 'active', source: 'box' };
+  const req = { headers: { authorization: 'Bearer boxtoken' } }; // no req.allowBoxScope
+  const res = fakeRes();
+  let nexted = false;
+  await auth.requireBuilder(req, res, () => { nexted = true; });
+  assert.equal(nexted, false, 'a box session must not reach a route without allowBoxScope');
+  assert.equal(res._status, 403);
+  assert.equal(res._json.error.code, 'box_scope');
+});
+
+// ---- box session ALLOWED when the route opted in -----------------------------
+await t('box session + allowBoxScope (middleware ran) → next() called, req.builder set', async () => {
+  nextSession = { builder_id: 3, github_login: 'boxbot', rank: 'metic', status: 'active', source: 'box' };
+  // Simulate the real chain: allowBoxScope runs first and flags the request.
+  const req = { headers: { authorization: 'Bearer boxtoken' } };
+  auth.allowBoxScope(req, fakeRes(), () => {});
+  const res = fakeRes();
+  let nexted = false;
+  await auth.requireBuilder(req, res, () => { nexted = true; });
+  assert.equal(nexted, true, 'a box session must pass on an allow-listed route');
+  assert.equal(res._status, null);
+  assert.equal(req.builder.rank, 'metic');
+});
+
+// ---- cli / web sessions are unaffected by the box gate -----------------------
+await t('cli session on a non-box route → unaffected, next() called', async () => {
+  nextSession = { builder_id: 1, github_login: 'lars589', rank: 'archon', status: 'active', source: 'cli' };
+  const req = { headers: { authorization: 'Bearer clitoken' } }; // no allowBoxScope
+  const res = fakeRes();
+  let nexted = false;
+  await auth.requireBuilder(req, res, () => { nexted = true; });
+  assert.equal(nexted, true, 'a full cli session is never box-gated');
+  assert.equal(res._status, null);
+});
+
+await t('web session on a non-box route → unaffected, next() called', async () => {
+  nextSession = { builder_id: 9, github_login: 'weber', rank: 'metic', status: 'active', source: 'web' };
+  const req = { headers: { cookie: 'gds_session=webtoken' } };
+  const res = fakeRes();
+  let nexted = false;
+  await auth.requireBuilder(req, res, () => { nexted = true; });
+  assert.equal(nexted, true);
+  assert.equal(res._status, null);
+});
+
+// ---- a legacy session with no source field is NOT treated as a box -----------
+await t('session with no source field → not box-gated (only source==="box" fires)', async () => {
+  nextSession = { builder_id: 2, github_login: 'legacy', rank: 'metic', status: 'active' }; // no source
+  const req = { headers: { authorization: 'Bearer legacytoken' } };
+  const res = fakeRes();
+  let nexted = false;
+  await auth.requireBuilder(req, res, () => { nexted = true; });
+  assert.equal(nexted, true, 'absent source must never trip the box gate');
+  assert.equal(res._status, null);
+});
+
+console.log(`\n${pass} passed, ${fail} failed`);
+process.exit(fail === 0 ? 0 : 1);

package/tests/box_ship_permissions.mjs

@@ -0,0 +1,71 @@
+// tests/box_ship_permissions.mjs
+//
+// task 1051 (D): the blessed methodology CLI scripts must stay pre-allowed in the
+// project .claude/settings.json so a dev-box Claude session (auto permission mode)
+// does not hard-DENY the very command it exists to run. The #1027 nightmare
+// dead-ended on `node scripts/gds/ship.js` at the auto classifier; this guards
+// against that allow-rule being silently dropped.
+//
+// Run:  node tests/box_ship_permissions.mjs
+
+import { strict as assert } from 'node:assert';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const settingsPath = path.join(__dirname, '..', '.claude', 'settings.json');
+
+let passed = 0, failed = 0;
+function test(name, fn) {
+  try { fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (err) { failed++; console.log(`  FAIL ${name}\n     ${err.message}`); }
+}
+
+const raw = fs.readFileSync(settingsPath, 'utf8');
+let settings;
+test('.claude/settings.json is valid JSON', () => {
+  settings = JSON.parse(raw);
+});
+
+test('permissions.allow pre-allows the blessed ship/claim/reauth scripts (box auto-mode would deny them otherwise)', () => {
+  const allow = (settings.permissions && settings.permissions.allow) || [];
+  // The exact command the #1027 nightmare hard-stopped on:
+  assert.ok(allow.includes('Bash(node scripts/gds/ship.js:*)'),
+    'ship.js MUST be pre-allowed — a dev box cannot complete a ship if its own classifier denies the command');
+  // The rest of the core ship loop a box runs hands-free:
+  for (const s of ['claim', 'reauth', 'release', 'paste-token']) {
+    assert.ok(allow.includes(`Bash(node scripts/gds/${s}.js:*)`), `${s}.js should be pre-allowed`);
+  }
+});
+
+test('permissions.allow pre-allows the generic GDS API channel api.js (auto-mode denies the whole autonomous GDS loop otherwise)', () => {
+  const allow = (settings.permissions && settings.permissions.allow) || [];
+  // task 1716 (completes 1051): every GDS operation without a dedicated script —
+  // idea-triage promote, create-task, blocker-resolve, criterion ratify, goal
+  // create, cost-via-API, security reports — rides the generic caller
+  // `node scripts/gds/api.js <METHOD> /api/gds/...`. If it is not pre-allowed, a
+  // dev-box (or laptop) session in AUTO permission mode has the classifier
+  // hard-DENY those writes as "[External System Writes] ... beyond the user's
+  // request" — mistaking a sanctioned idea-triage session for scope creep. The
+  // GDS server enforces builders.rank on every request (ADR 0016), so this rule
+  // grants nothing beyond the caller's rank; it removes a redundant, weaker,
+  // wrong harness prompt (owner-decided 2026-07-02, ADR 0104).
+  assert.ok(allow.includes('Bash(node scripts/gds/api.js:*)'),
+    'api.js MUST be pre-allowed — the autonomous GDS loop (promote/create-task/blocker-resolve/cost) rides this generic channel; auto-mode denies it otherwise');
+});
+
+test('every allow-rule points at a script that actually exists (no inert rules)', () => {
+  const allow = (settings.permissions && settings.permissions.allow) || [];
+  const re = /^Bash\(node (scripts\/gds\/[a-z-]+\.js):\*\)$/;
+  for (const rule of allow) {
+    const m = rule.match(re);
+    if (!m) continue; // only audit the gds-script rules
+    const p = path.join(__dirname, '..', m[1]);
+    assert.ok(fs.existsSync(p), `allow-rule references a missing script: ${m[1]}`);
+  }
+});
+
+console.log('');
+console.log(`box_ship_permissions: ${passed} passed, ${failed} failed`);
+process.exit(failed === 0 ? 0 : 1);

package/tests/box_terminal_ssrf.mjs

@@ -0,0 +1,90 @@
+// tests/box_terminal_ssrf.mjs
+//
+// SECURITY regression guard for #871 — the box web-terminal URL allow-list.
+// POST /box/terminal stores a builder-supplied URL and GET /box/terminal makes
+// the WEB TIER fetch it. The old guard (/^https:\/\/[^\s]+$/) accepted ANY https
+// host, so a builder could make the prod server probe internal/metadata
+// endpoints (SSRF). isSafeTerminalUrl(url, login) must allow ONLY the two real
+// tunnel shapes — `term-<login>.…amazonprimea.com` (bound to the caller's login)
+// and `*.trycloudflare.com` — and reject everything else.
+//
+// Pure function, no server/DB/network.
+//
+// Run:  node tests/box_terminal_ssrf.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const { isSafeTerminalUrl } = require('../modules/dev-box/routes/box.js');
+
+let pass = 0, fail = 0;
+const test = (name, fn) => {
+  try { fn(); pass++; console.log(`PASS  ${name}`); }
+  catch (e) { fail++; console.log(`FAIL  ${name}\n      ${e.message}`); }
+};
+
+const LOGIN = 'lars589';
+
+// ---- allowed: the two legitimate tunnel shapes -------------------------------
+test('allows the named-tunnel apex host bound to the caller login', () => {
+  assert.equal(isSafeTerminalUrl('https://term-lars589.amazonprimea.com', LOGIN), true);
+});
+test('allows the named-tunnel dev-zone host (term-<login>.dev.amazonprimea.com)', () => {
+  assert.equal(isSafeTerminalUrl('https://term-lars589.dev.amazonprimea.com/', LOGIN), true);
+});
+test('allows a Cloudflare quick-tunnel host (*.trycloudflare.com)', () => {
+  assert.equal(isSafeTerminalUrl('https://random-words-1234.trycloudflare.com', LOGIN), true);
+});
+test('login match is case-insensitive (DNS is case-insensitive)', () => {
+  assert.equal(isSafeTerminalUrl('https://term-LarsCode.amazonprimea.com', 'larscode'), true);
+});
+
+// ---- rejected: SSRF targets --------------------------------------------------
+for (const bad of [
+  'https://127.0.0.1/admin',
+  'https://127.0.0.1:9443/',
+  'https://10.0.0.5:8443/',
+  'https://192.168.1.10/',
+  'https://172.16.0.9/',
+  'https://169.254.169.254/metadata/v1/',     // cloud metadata
+  'https://[::1]:443/',                        // ipv6 loopback literal
+  'https://localhost/',
+  'https://vault.internal:8200/',
+  'https://printer.local/',
+]) {
+  test(`rejects SSRF target ${bad}`, () => {
+    assert.equal(isSafeTerminalUrl(bad, LOGIN), false);
+  });
+}
+
+// ---- rejected: wrong scheme / shape / cross-login ----------------------------
+test('rejects http (must be https)', () => {
+  assert.equal(isSafeTerminalUrl('http://term-lars589.amazonprimea.com', LOGIN), false);
+});
+test('rejects embedded credentials (user:pass@host)', () => {
+  assert.equal(isSafeTerminalUrl('https://user:pass@term-lars589.amazonprimea.com', LOGIN), false);
+});
+test('rejects another builder\'s term- host (login binding)', () => {
+  assert.equal(isSafeTerminalUrl('https://term-someoneelse.amazonprimea.com', LOGIN), false);
+});
+test('rejects a non-tunnel host on the project domain', () => {
+  assert.equal(isSafeTerminalUrl('https://api.amazonprimea.com', LOGIN), false);
+});
+test('rejects an arbitrary external host', () => {
+  assert.equal(isSafeTerminalUrl('https://evil.example.com', LOGIN), false);
+});
+test('rejects a lookalike suffix (…trycloudflare.com.evil.com)', () => {
+  assert.equal(isSafeTerminalUrl('https://x.trycloudflare.com.evil.com', LOGIN), false);
+});
+test('rejects garbage / unparseable', () => {
+  assert.equal(isSafeTerminalUrl('not a url', LOGIN), false);
+  assert.equal(isSafeTerminalUrl('', LOGIN), false);
+  assert.equal(isSafeTerminalUrl(null, LOGIN), false);
+});
+test('rejects when login is empty (cannot bind the term- form)', () => {
+  assert.equal(isSafeTerminalUrl('https://term-lars589.amazonprimea.com', ''), false);
+});
+
+console.log(`\n${pass} passed, ${fail} failed`);
+process.exit(fail === 0 ? 0 : 1);