@bongos/core 1.19.1072 → 1.19.1074

package/tests/box_dns_repoint.mjs

@@ -1,153 +0,0 @@
-// tests/box_dns_repoint.mjs
-//
-// Hermetic coverage for the box DNS-repoint reliability fix (task 1180 — the
-// @kingaonline "handshake timeout" outage: a transient Cloudflare auth blip on the
-// zone lookup left box-<login>.dev pinned at a dead IP while provision reported
-// success). NO network, NO Cloudflare, NO DB:
-//
-//   Part A — drives infra/box-dns-cloudflare.sh with a STUBBED `curl` on PATH to
-//     prove: (1) a transient first-attempt blip self-heals via retry; (2) a real CF
-//     auth error surfaces the REAL code (not the old misleading "zone not found");
-//     (3) a genuinely-missing zone still says so; (4) --delete is idempotent.
-//   Part B — imports scripts/gds/box.js and proves runDnsHook / runDnsHookBlackhole
-//     RETURN ok:false on failure (the "stop swallowing" contract) instead of
-//     silently continuing, AND that runDnsHookBlackhole REPOINTS the record to the
-//     non-routable sentinel 192.0.2.1 (idea 309) rather than deleting it.
-//
-// Run:  node tests/box_dns_repoint.mjs
-
-import { strict as assert } from 'node:assert';
-import { createRequire } from 'node:module';
-import { spawnSync } from 'node:child_process';
-import { fileURLToPath } from 'node:url';
-import { skipUnlessPresent } from './helpers.mjs';
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-
-const require = createRequire(import.meta.url);
-const here = path.dirname(fileURLToPath(import.meta.url));
-const repo = path.resolve(here, '..');
-const HOOK = path.join(repo, 'infra', 'box-dns-cloudflare.sh');
-skipUnlessPresent('infra/box-dns-cloudflare.sh');
-
-// ── a fake `curl` that emulates the Cloudflare API per FAKE_CF_SCENARIO ─────────
-const FAKE_CURL = `#!/usr/bin/env node
-const fs = require('fs');
-const args = process.argv.slice(2);
-const url = args.find(a => a.startsWith('http')) || '';
-const mi = args.indexOf('-X');
-const method = mi >= 0 ? args[mi + 1] : 'GET';
-const scen = process.env.FAKE_CF_SCENARIO || '';
-const counter = process.env.FAKE_CF_COUNTER;
-function bump() { let n = 0; try { n = parseInt(fs.readFileSync(counter, 'utf8')) || 0; } catch (e) {} n++; fs.writeFileSync(counter, String(n)); return n; }
-const ok = (result) => JSON.stringify({ success: true, errors: [], result });
-const fail = (code, message) => JSON.stringify({ success: false, errors: [{ code, message }], result: null });
-let out = '';
-if (url.includes('/zones?name=')) {
-  if (scen === 'retry_zone') out = bump() === 1 ? '' : ok([{ id: 'ZONE123' }]);      // transient empty, then OK
-  else if (scen === 'auth_fail') out = fail(1000, 'Invalid API Token');               // persistent auth error
-  else if (scen === 'zone_missing') out = ok([]);                                      // success, no such zone
-  else out = ok([{ id: 'ZONE123' }]);
-} else if (url.includes('/dns_records?type=A')) {
-  out = (scen === 'delete_noop') ? ok([]) : ok([{ id: 'REC456' }]);
-} else if (method === 'PUT') out = ok({ id: 'REC456' });
-else if (method === 'POST') out = ok({ id: 'REC789' });
-else if (method === 'DELETE') out = ok({ id: 'REC456' });
-else out = ok([]);
-process.stdout.write(out);
-`;
-
-const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'otb-dns-'));
-const curlPath = path.join(tmp, 'curl');
-fs.writeFileSync(curlPath, FAKE_CURL, { mode: 0o755 });
-const counterFile = path.join(tmp, 'counter');
-
-function runHook(scenario, extraEnv = {}, retries = '4') {
-  fs.writeFileSync(counterFile, '0');
-  const res = spawnSync('bash', [HOOK], {
-    encoding: 'utf8',
-    env: {
-      ...process.env,
-      PATH: `${tmp}:${process.env.PATH}`,
-      CLOUDFLARE_API_TOKEN: 'faketoken',
-      CLOUDFLARE_ZONE: 'example.com',
-      BOX_HOSTNAME: 'box-test.dev.example.com',
-      BOX_DNS_BACKOFF_BASE: '0', // no real sleeps in tests
-      BOX_DNS_RETRIES: retries,
-      FAKE_CF_SCENARIO: scenario,
-      FAKE_CF_COUNTER: counterFile,
-      ...extraEnv,
-    },
-  });
-  return { status: res.status, out: `${res.stdout || ''}${res.stderr || ''}` };
-}
-
-// 1) transient blip on the FIRST zone lookup self-heals via retry → success
-{
-  const r = runHook('retry_zone', { BOX_IP: '1.2.3.4' });
-  assert.equal(r.status, 0, `retry should self-heal to exit 0; got ${r.status} :: ${r.out}`);
-  assert.match(r.out, /updated A box-test\.dev\.example\.com -> 1\.2\.3\.4/, r.out);
-  const attempts = parseInt(fs.readFileSync(counterFile, 'utf8'));
-  assert.ok(attempts >= 2, `zone lookup should have been retried (>=2 attempts), got ${attempts}`);
-}
-
-// 2) a REAL Cloudflare auth error surfaces the real code, NOT the old misleading text
-{
-  const r = runHook('auth_fail', { BOX_IP: '1.2.3.4' }, '2');
-  assert.notEqual(r.status, 0, 'persistent auth failure must exit non-zero');
-  assert.match(r.out, /1000/, `should surface the real CF error code 1000 :: ${r.out}`);
-  assert.doesNotMatch(r.out, /genuinely not found/, `auth error must NOT be reported as a missing zone :: ${r.out}`);
-}
-
-// 3) a genuinely-missing zone (success + empty result) is still reported as such
-{
-  const r = runHook('zone_missing', { BOX_IP: '1.2.3.4' });
-  assert.notEqual(r.status, 0, 'missing zone must exit non-zero');
-  assert.match(r.out, /genuinely not found/, r.out);
-}
-
-// 4) delete mode is idempotent: no-op when the record is absent, deletes when present
-{
-  const noop = runHook('delete_noop', { BOX_DNS_DELETE: '1' });
-  assert.equal(noop.status, 0, `delete of an absent record is a no-op (exit 0); got ${noop.status} :: ${noop.out}`);
-  assert.match(noop.out, /nothing to delete/, noop.out);
-
-  const hit = runHook('delete_hit', { BOX_DNS_DELETE: '1' });
-  assert.equal(hit.status, 0, `delete of a present record exits 0; got ${hit.status} :: ${hit.out}`);
-  assert.match(hit.out, /deleted A box-test\.dev\.example\.com/, hit.out);
-}
-
-// ── Part B: runDnsHook / runDnsHookBlackhole contract + the idea-309 repoint ────
-{
-  const box = require('../scripts/gds/box.js');
-  const upOk = box.runDnsHook('box-x.dev.example.com', '1.2.3.4', 'exit 0');
-  assert.equal(upOk.ok, true, 'runDnsHook returns ok:true when the hook succeeds');
-
-  const upFail = box.runDnsHook('box-x.dev.example.com', '1.2.3.4', 'exit 1');
-  assert.equal(upFail.ok, false, 'runDnsHook returns ok:false when the hook FAILS (no silent swallow)');
-
-  const noIp = box.runDnsHook('box-x.dev.example.com', null, 'exit 1');
-  assert.equal(noIp.ok, true, 'runDnsHook is a no-op (ok:true skipped) when ip is absent');
-
-  // idea 309: on deprovision the box lifecycle REPOINTS the record to the
-  // non-routable sentinel 192.0.2.1 (never deletes) — so a reap→rebuild can't open
-  // an NXDOMAIN window. Drive runDnsHookBlackhole with a hook that captures the
-  // BOX_IP it is handed, and assert it is the sentinel via the upsert path.
-  const probe = path.join(tmp, 'blackhole-ip');
-  process.env.PROBE_FILE = probe;
-  const captureHook = `node -e 'require("fs").writeFileSync(process.env.PROBE_FILE, process.env.BOX_IP || "MISSING")'`;
-  const bhOk = box.runDnsHookBlackhole('box-x.dev.example.com', captureHook);
-  assert.equal(bhOk.ok, true, 'runDnsHookBlackhole returns ok:true when the hook succeeds');
-  assert.equal(fs.readFileSync(probe, 'utf8'), '192.0.2.1', 'runDnsHookBlackhole must REPOINT to the 192.0.2.1 sentinel (not delete)');
-  delete process.env.PROBE_FILE;
-
-  const bhFail = box.runDnsHookBlackhole('box-x.dev.example.com', 'exit 1');
-  assert.equal(bhFail.ok, false, 'runDnsHookBlackhole returns ok:false when the hook FAILS (best-effort, but still reports)');
-
-  const bhNoHook = box.runDnsHookBlackhole('box-x.dev.example.com', null);
-  assert.equal(bhNoHook.ok, true, 'runDnsHookBlackhole is a no-op (ok:true skipped) when no hook is configured');
-}
-
-fs.rmSync(tmp, { recursive: true, force: true });
-console.log('box_dns_repoint: all assertions passed');

package/tests/box_env.mjs

@@ -1,64 +0,0 @@
-// tests/box_env.mjs
-//
-// task 1002466 — a provisioned box's cloud-init baked NO GDS_BASE, so any on-box
-// script that (unlike infra/box-report-*.sh) doesn't fall back to deriving it from
-// the session file's api_base had nothing telling it which instance to talk to.
-// box.js now bakes GDS_BASE explicitly via the pure buildBoxEnv() helper, split
-// out of cmdProvision so this can be pinned without DB/DO/Cloudflare.
-//
-// Pure + hermetic: buildBoxEnv takes plain inputs and returns a string. No DB, no
-// network, no droplet.
-//
-// Run:  node tests/box_env.mjs
-
-import { strict as assert } from 'node:assert';
-import { createRequire } from 'node:module';
-import { makeRunner } from './helpers.mjs';
-
-const require = createRequire(import.meta.url);
-const box = require('../scripts/gds/box.js');
-
-const { test, summary } = makeRunner();
-
-await test('bakes GDS_BASE as the FULL api base (origin + /api/bongos) — matches box-report-*.sh, not box-heartbeat.sh\'s bare-origin BASE', () => {
-  const env = box.buildBoxEnv({ apiOrigin: 'https://cloudbongos.com' });
-  assert.match(env, /^GDS_BASE=https:\/\/cloudbongos\.com\/api\/bongos$/m);
-});
-
-await test('strips a trailing slash off the origin before appending /api/bongos', () => {
-  const env = box.buildBoxEnv({ apiOrigin: 'https://cloudbongos.com/' });
-  assert.match(env, /^GDS_BASE=https:\/\/cloudbongos\.com\/api\/bongos$/m);
-  assert.ok(!env.includes('//api/bongos'), 'must not double the slash');
-});
-
-await test('no named tunnel: box.env carries GDS_BASE and nothing else', () => {
-  const env = box.buildBoxEnv({ apiOrigin: 'https://cloudbongos.com' });
-  assert.ok(!/BOX_TUNNEL_TOKEN|BOX_TERMINAL_HOSTNAME|BOX_TERMINAL_CREDENTIAL|BOX_PREVIEW_HOSTNAME/.test(env));
-});
-
-await test('named tunnel: box.env carries GDS_BASE AND all four tunnel vars', () => {
-  const env = box.buildBoxEnv({
-    apiOrigin: 'https://cloudbongos.com',
-    namedTunnel: {
-      token: 'tok123', hostname: 'term-alice.example.com',
-      credential: 'cred456', previewHostname: 'sandbox-alice.example.com',
-    },
-  });
-  assert.match(env, /^GDS_BASE=https:\/\/cloudbongos\.com\/api\/bongos$/m);
-  assert.match(env, /^BOX_TUNNEL_TOKEN=tok123$/m);
-  assert.match(env, /^BOX_TERMINAL_HOSTNAME=term-alice\.example\.com$/m);
-  assert.match(env, /^BOX_TERMINAL_CREDENTIAL=cred456$/m);
-  assert.match(env, /^BOX_PREVIEW_HOSTNAME=sandbox-alice\.example\.com$/m);
-});
-
-await test('every line is a clean KEY=VALUE (or a comment) — no leftover template gaps', () => {
-  const env = box.buildBoxEnv({
-    apiOrigin: 'https://cloudbongos.com',
-    namedTunnel: { token: 't', hostname: 'h', credential: 'c', previewHostname: 'p' },
-  });
-  for (const line of env.split('\n').filter(Boolean)) {
-    assert.ok(/^#/.test(line) || /^[A-Z_]+=\S+$/.test(line), `unexpected line shape: ${line}`);
-  }
-});
-
-summary();

package/tests/box_host_keys.mjs

@@ -1,126 +0,0 @@
-// tests/box_host_keys.mjs
-//
-// Hermetic unit test for box-onboard.validateHostKeyLines (task 1187 / idea 235) —
-// the pure validator that gates what a box may report as its SSH host keys before
-// the GDS stores them and the connect path writes them into known_hosts. NO DB, NO
-// network. Fixtures are REAL ssh public keys (the validator decodes the blob).
-//
-// Run:  node tests/box_host_keys.mjs
-
-import { strict as assert } from 'node:assert';
-import { createRequire } from 'node:module';
-
-const require = createRequire(import.meta.url);
-const { validateHostKeyLines, MAX_HOST_KEY_LINES } = require('../modules/dev-box/box-onboard.js');
-
-// Real public keys (type + base64, comment dropped) — generated with ssh-keygen.
-const ED = 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPCoIEgcBiGqM2Rd0rgfw0d7rHccvbpSe3vsSN7brif/';
-const EC = 'ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBGWPW+MhwAnlUVCs+QxvXoX0zdpSN3JCJGZ8AaffThbwJQ2CLMtRRkxiQqO/alJ1nj4Yc2SbXhB6E+RZXkllkvs=';
-const RSA = 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC/FqVQUVRAmcDHRBeEZZwuW0xgsAPTm1NpPlYlY4rVF2W8llM0AKXlfqYoXmKUvCmuhTUo+d/0mRbMXS8rcDyDB2zZbLNL7wSMqsL0EW0xw+GFVDARInwhnKGhPS1fbSYSS+FYlBtacPmFByO3Tw5hloqKViKTJkbMPT/ZFhyhcvFAu5ssEyMM4f5AXGFEaZ8tjzZKEAvr3LXR+X5/sknUP4YgwjJI/sOToorisjOsG9nnNs5mbhFiwQORlCmYuKuGmJuBxbCufva+9mMYPgVLS3IMavdra+31OyFUGZRAFPSDODIow1LWfQoq/bcFLt9/US+A2TeloBNc7QB2hIGn';
-
-// 1) clean multi-type report → accepted, normalized, all three lines preserved
-{
-  const r = validateHostKeyLines([ED, EC, RSA].join('\n'));
-  assert.equal(r.ok, true, `clean report should pass: ${JSON.stringify(r)}`);
-  assert.equal(r.lines.length, 3);
-  assert.deepEqual(r.lines, [ED, EC, RSA], 'normalized to `<type> <base64>`, order preserved');
-}
-
-// 1b) trailing newline / blank lines are tolerated (a .pub file has a trailing \n)
-{
-  const r = validateHostKeyLines(`${ED}\n\n${RSA}\n`);
-  assert.equal(r.ok, true, JSON.stringify(r));
-  assert.equal(r.lines.length, 2);
-}
-
-// 2) ed25519 alone is enough
-{
-  assert.equal(validateHostKeyLines(ED).ok, true);
-}
-
-// 3) NO ed25519 line → rejected (the 925/926 'green but Host denied' failure)
-{
-  const r = validateHostKeyLines([EC, RSA].join('\n'));
-  assert.equal(r.ok, false);
-  assert.equal(r.error, 'missing_ed25519');
-}
-
-// 4) a hostname prefix (3 fields) → refused, not silently trimmed
-{
-  const r = validateHostKeyLines(`box-x.dev.example.com ${ED}`);
-  assert.equal(r.ok, false);
-  assert.equal(r.error, 'expect_type_and_key_only');
-}
-
-// 4b) a trailing comment / extra field → also refused
-{
-  const r = validateHostKeyLines(`${ED} root@box`);
-  assert.equal(r.ok, false);
-  assert.equal(r.error, 'expect_type_and_key_only');
-}
-
-// 5) a control char inside a line → rejected (injection guard)
-{
-  const r = validateHostKeyLines(`ssh-ed25519 AAAA\x07BBBB`);
-  assert.equal(r.ok, false, 'control char must be rejected');
-}
-
-// 6) too many lines → capped
-{
-  const many = Array.from({ length: MAX_HOST_KEY_LINES + 1 }, () => ED).join('\n');
-  const r = validateHostKeyLines(many);
-  assert.equal(r.ok, false);
-  assert.equal(r.error, 'too_many_lines');
-}
-
-// 7) bad base64 → rejected
-{
-  const r = validateHostKeyLines('ssh-ed25519 not-valid-base64!!!');
-  assert.equal(r.ok, false);
-}
-
-// 8) unknown key type → rejected
-{
-  const r = validateHostKeyLines(`ssh-frobnicate ${ED.split(' ')[1]}`);
-  assert.equal(r.ok, false);
-}
-
-// 9) empty / whitespace → rejected
-{
-  assert.equal(validateHostKeyLines('').ok, false);
-  assert.equal(validateHostKeyLines('   \n  ').ok, false);
-  assert.equal(validateHostKeyLines(42).ok, false);
-}
-
-// 10) a bare key type with no body (1 field) → refused
-{
-  const r = validateHostKeyLines('ssh-ed25519');
-  assert.equal(r.ok, false);
-  assert.equal(r.error, 'expect_type_and_key_only');
-}
-
-// 11) hostKeysAreStale (task 1002509) — a rebuild mints fresh host keys, and the row
-// keeps the OLD ones until the new box re-reports. Serving those is the "Host denied
-// (verification failed)" lockout, so a report that predates the current droplet's
-// activation must be refused and the client must keyscan instead.
-{
-  const { hostKeysAreStale } = require('../modules/dev-box/boxes.js');
-  assert.equal(
-    hostKeysAreStale({ hostKeysAt: '2026-07-01T08:00:00Z', activeSince: '2026-07-01T09:00:00Z' }),
-    true,
-    'a report older than the activation describes a box that no longer exists'
-  );
-  assert.equal(
-    hostKeysAreStale({ hostKeysAt: '2026-07-01T10:00:00Z', activeSince: '2026-07-01T09:00:00Z' }),
-    false,
-    'a report from after this box came up is the live identity'
-  );
-  assert.equal(hostKeysAreStale({ hostKeysAt: null, activeSince: '2026-07-01T09:00:00Z' }), true);
-  assert.equal(hostKeysAreStale({ hostKeysAt: '2026-07-01T10:00:00Z', activeSince: null }), true);
-  assert.equal(hostKeysAreStale({}), true, 'no evidence of freshness → not fresh');
-  assert.equal(hostKeysAreStale({ hostKeysAt: 'garbage', activeSince: '2026-07-01T09:00:00Z' }), true);
-  const t = new Date('2026-07-01T09:00:00Z');
-  assert.equal(hostKeysAreStale({ hostKeysAt: t, activeSince: t }), false, 'Date objects, equal instant → fresh');
-}
-
-console.log('box_host_keys: all assertions passed');

package/tests/box_infra_resolve.mjs

@@ -1,246 +0,0 @@
-// tests/box_infra_resolve.mjs
-//
-// R98 (goal 1000051/1000052, ADR 0150) — box.js locates the box cloud-init from
-// the INSTANCE root (not the vendored @bongos/core package) and FAILS LOUD when it
-// cannot, so a box can never be provisioned with empty user-data (= a bare box that
-// boots with no clone, no toolchain, no terminal).
-//
-// Pure + hermetic: boxInfraCandidates takes injected {env, repoRoot}; readCloudInit
-// takes an explicit infraDir. Temp dirs stand in for a real infra/ tree. NO DB, NO
-// network, NO droplet — requiring box.js does not run main() (require.main guard)
-// and loadDeps() (the DB layer) is only reached inside main().
-//
-// Run:  node tests/box_infra_resolve.mjs
-
-import { strict as assert } from 'node:assert';
-import { createRequire } from 'node:module';
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { makeRunner } from './helpers.mjs';
-
-// This repo's root — the boundary tests at the bottom read the REAL tree.
-const REPO_ROOT = path.join(path.dirname(fileURLToPath(import.meta.url)), '..');
-
-const require = createRequire(import.meta.url);
-const box = require('../scripts/gds/box.js');
-
-const { test, summary } = makeRunner();
-
-// The 9 scripts readCloudInit gz+b64-inlines into the cloud-init — missing ANY of
-// them half-wires the box. Kept in sync with box.js's fileGzB64 calls.
-const INLINED = [
-  'box-source-fetch.sh', 'box-authorized-keys-fetch.sh', 'box-terminal.service',
-  'box-terminal-credsync.service', 'box-terminal-credential.path', 'cloudflared.service',
-  'cloudflared-run.sh', 'close-box.sh', 'otb-box-launch.sh',
-];
-const TEMPLATE = box.BOX_INFRA_TEMPLATE; // 'builder-box-cloud-init.yaml'
-
-// A minimal template exercising a few of the substitution tokens (readCloudInit
-// still calls fileGzB64 for ALL 9 inlined files regardless, so the happy path must
-// provide every one).
-const TEMPLATE_BODY = [
-  '#cloud-config',
-  'write_files:',
-  '  - path: /opt/box-source-fetch.sh',
-  '    encoding: gz+b64',
-  '    content: __BOX_SOURCE_FETCH_B64__',
-  '  - path: /opt/cloudflared-run.sh',
-  '    encoding: gz+b64',
-  '    content: __CLOUDFLARED_RUN_B64__',
-  'runcmd:',
-  '  - git clone __REPO_URL__ /workspace',
-  '',
-].join('\n');
-
-const tmps = [];
-function tmpdir() {
-  const d = fs.mkdtempSync(path.join(os.tmpdir(), 'boxinfra-'));
-  tmps.push(d);
-  return d;
-}
-// Build an infra/ dir; choose whether the template + which inlined files exist.
-function makeInfra({ template = true, inlined = INLINED } = {}) {
-  const root = tmpdir();
-  const infra = path.join(root, 'infra');
-  fs.mkdirSync(infra, { recursive: true });
-  if (template) fs.writeFileSync(path.join(infra, TEMPLATE), TEMPLATE_BODY);
-  for (const f of inlined) fs.writeFileSync(path.join(infra, f), `# ${f}\n`);
-  return { root, infra };
-}
-
-// ===========================================================================
-// boxInfraCandidates — ordering (pure, injected; ADR 0150 prong A)
-// ===========================================================================
-// Expected candidates are built with path.join/path.resolve — the same calls
-// boxInfraCandidates makes — never as literal POSIX strings (task 1003821). A
-// hardcoded '/inst/infra' is 'C:\inst\infra' once the code has run it through
-// path.resolve, so these two tests were permanently red for every Windows builder
-// while ubuntu CI stayed green. A known-noise entry in a local baseline is the
-// thing that teaches a reader to skim the fail list instead of diffing it by name.
-const VENDORED_ROOT = '/srv/app/node_modules/@bongos/core';
-
-await test('candidate order: override → explicit instance root → repoRoot → node_modules walk-up', () => {
-  const env = { BONGOS_BOX_INFRA_DIR: '/ovr', BONGOS_INSTANCE_ROOT: '/inst' };
-  const c = box.boxInfraCandidates({ env, repoRoot: VENDORED_ROOT });
-  assert.equal(c[0], path.resolve('/ovr'), 'explicit override is first');
-  assert.equal(c[1], path.join(path.resolve('/inst'), 'infra'), 'then the explicit instance root');
-  assert.equal(c[2], path.join(VENDORED_ROOT, 'infra'), 'then REPO_ROOT/infra');
-  // the load-bearing case: a vendored core walks UP out of node_modules to its host
-  // instance root, so infra/ is found with no pointer at all.
-  assert.ok(c.includes(path.join('/srv/app', 'infra')), 'walk-up recovers the host instance root infra/');
-});
-
-await test('repoRoot/infra precedes its ancestors in the walk-up (robust to any cwd pointer)', () => {
-  const c = box.boxInfraCandidates({ env: {}, repoRoot: '/x/y/z' });
-  const i0 = c.indexOf(path.join('/x/y/z', 'infra'));
-  const i1 = c.indexOf(path.join('/x/y', 'infra'));
-  const i2 = c.indexOf(path.join('/x', 'infra'));
-  assert.ok(i0 >= 0 && i1 > i0 && i2 > i1, 'repoRoot/infra, then /x/y/infra, then /x/infra — in order');
-});
-
-// ===========================================================================
-// resolveBoxInfraDir — picks the FIRST candidate that actually holds the template
-// ===========================================================================
-await test('resolveBoxInfraDir picks the override dir when it holds the template', () => {
-  const { infra } = makeInfra();
-  const got = box.resolveBoxInfraDir({ env: { BONGOS_BOX_INFRA_DIR: infra }, repoRoot: '/nope/does/not/exist' });
-  assert.equal(got, infra);
-});
-
-await test('resolveBoxInfraDir falls THROUGH a template-less override to the instance-root infra/', () => {
-  const emptyOverride = path.join(tmpdir(), 'infra');
-  fs.mkdirSync(emptyOverride, { recursive: true }); // exists, but no template inside
-  const { infra } = makeInfra();                    // a real infra/ to fall through to
-  const instRoot = path.dirname(infra);             // <root>, so <root>/infra === the real one
-  const got = box.resolveBoxInfraDir({
-    env: { BONGOS_BOX_INFRA_DIR: emptyOverride, BONGOS_INSTANCE_ROOT: instRoot },
-    repoRoot: '/nope',
-  });
-  assert.equal(got, infra, 'skips the template-less override, takes the instance-root infra/');
-});
-
-await test('resolveBoxInfraDir → null when NO candidate holds the template', () => {
-  const bare = tmpdir(); // a dir tree with no infra/ anywhere
-  const got = box.resolveBoxInfraDir({ env: {}, repoRoot: path.join(bare, 'node_modules', '@bongos', 'core') });
-  assert.equal(got, null);
-});
-
-// ===========================================================================
-// readCloudInit — FAIL LOUD (ADR 0150 prong B): never return null / empty
-// ===========================================================================
-await test('readCloudInit THROWS when infra cannot be located (never returns null)', () => {
-  assert.throws(
-    () => box.readCloudInit({ infraDir: null }),
-    /not found|boot bare|ADR 0150/i,
-  );
-});
-
-await test('readCloudInit THROWS when infra is INCOMPLETE (an inlined script is missing)', () => {
-  const { infra } = makeInfra({ inlined: INLINED.filter((f) => f !== 'cloudflared-run.sh') });
-  assert.throws(
-    () => box.readCloudInit({ infraDir: infra }),
-    /incomplete|cloudflared-run\.sh|ADR 0150/i,
-  );
-});
-
-// ===========================================================================
-// readCloudInit — happy path: renders non-empty + every placeholder substituted
-// ===========================================================================
-await test('readCloudInit renders a non-empty cloud-init with no leftover __PLACEHOLDER__ tokens', () => {
-  const { infra } = makeInfra();
-  const out = box.readCloudInit({
-    infraDir: infra, authorizedKeysBlock: 'ssh-ed25519 AAAA', boxEnv: 'X=1', gdsSession: '{"t":1}',
-  });
-  assert.ok(out && out.length > 0, 'renders a non-empty cloud-init');
-  assert.ok(!/__[A-Z0-9_]+__/.test(out), 'no unsubstituted __PLACEHOLDER__ tokens remain');
-});
-
-// ===========================================================================
-// An UNKNOWN placeholder half-wires the box (task 1003635, ADR 0150 prong B)
-//
-// missingInfra only catches files this renderer knows to ask for. The other
-// direction — an instance template carrying a token box-infra.js never
-// substitutes — used to render straight through, leaving the literal token in
-// the cloud-init for cloud-init to write out as a file. ADR 0150 named the
-// assertion as an escalation and it was never implemented.
-// ===========================================================================
-
-await test('an UNKNOWN __TOKEN__ in the instance template is refused, not rendered through', () => {
-  const { infra } = makeInfra();
-  fs.appendFileSync(path.join(infra, TEMPLATE), '\n# __SOME_FUTURE_THING_B64__\n');
-  assert.throws(
-    () => box.readCloudInit({ infraDir: infra }),
-    (err) => /__SOME_FUTURE_THING_B64__/.test(err.message) && /placeholder|half-wired|ADR 0150/i.test(err.message),
-    'an unsubstituted placeholder must fail loud — rendering it through writes garbage onto the box',
-  );
-});
-
-await test('a misspelled AUTHORIZED_KEYS token cannot ship a permanently SSH-unreachable box', () => {
-  // The stakes case. A template that spells the key block even slightly wrong
-  // gets no substitution, so the box boots with a garbage authorized_keys and
-  // nobody can SSH in — the outcome task 1003635 reported, by the mechanism it
-  // did not find. It must be refused before DigitalOcean is touched.
-  const { infra } = makeInfra();
-  fs.appendFileSync(path.join(infra, TEMPLATE), '\n# __BUILDER_AUTHORIZED_KEY_B64__\n');
-  assert.throws(
-    () => box.readCloudInit({ infraDir: infra, authorizedKeysBlock: 'ssh-ed25519 AAAA' }),
-    /__BUILDER_AUTHORIZED_KEY_B64__/,
-  );
-});
-
-await test('the happy path still renders — the assertion does not fire on a correct template', () => {
-  const { infra } = makeInfra();
-  const out = box.readCloudInit({
-    infraDir: infra, authorizedKeysBlock: 'ssh-ed25519 AAAA', boxEnv: 'X=1', gdsSession: '{"t":1}',
-  });
-  assert.ok(out && out.length > 0, 'a correct template must still render');
-});
-
-// ===========================================================================
-// The core / instance boundary (task 1003635)
-//
-// The absence of the cloud-init set from the core's own infra/ was filed once as
-// a P1 outage ("a dev box becomes permanently SSH-unreachable"). It is not one —
-// ADR 0150 says the neutral core ships no box cloud-init, and the two throws
-// above are what make a missing one legible instead of dangerous. These pin that
-// boundary against the REAL tree so the next reader gets a test telling them so.
-// ===========================================================================
-
-await test('the INLINED list is exactly what box-infra.js actually asks fileGzB64 for', () => {
-  // The list above says "kept in sync with box.js's fileGzB64 calls" — by hand.
-  // Derive it instead, so adding a 10th inlined file cannot leave these tests
-  // silently proving less than they claim.
-  const SRC = fs.readFileSync(path.join(REPO_ROOT, 'scripts/gds/box-infra.js'), 'utf8');
-  const called = [...SRC.matchAll(/fileGzB64\('([^']+)'\)/g)].map((m) => m[1]);
-  assert.ok(called.length > 0, 'found no fileGzB64 calls — did box-infra.js move or get renamed?');
-  assert.deepEqual([...new Set(called)].sort(), [...INLINED].sort(),
-    'the INLINED fixture list has drifted from box-infra.js — the happy-path test would stop covering every inlined file');
-});
-
-await test('the neutral core ships NO box cloud-init — that is ADR 0150, not a missing file', () => {
-  const coreInfra = path.join(REPO_ROOT, 'infra');
-  assert.ok(!fs.existsSync(path.join(coreInfra, TEMPLATE)),
-    `the core now ships infra/${TEMPLATE}. ADR 0150 says it must not ("The neutral core still ships no infra/") — the cloud-init is instance-owned. If that decision changed, amend ADR 0150 and this test together.`);
-  for (const name of INLINED) {
-    assert.ok(!fs.existsSync(path.join(coreInfra, name)),
-      `infra/${name} is a cloud-init asset and belongs to the host instance, not the core (ADR 0150)`);
-  }
-});
-
-await test("core infra/ carries only the CLONE-RIDE scripts, which is why it looks half-empty", () => {
-  // The other population: these run on the box out of /workspace/infra/, arriving
-  // with the cloned source rather than through cloud-init. Their presence beside
-  // nine absences is the thing that reads as "files are missing" — infra/README.md
-  // exists to answer that, so it is required to stay.
-  const coreInfra = path.join(REPO_ROOT, 'infra');
-  for (const name of ['box-heartbeat.sh', 'box-report-host-keys.sh', 'box-report-terminal.sh', 'box-report-version.sh']) {
-    assert.ok(fs.existsSync(path.join(coreInfra, name)), `infra/${name} rides the clone and must stay in the core`);
-  }
-  assert.ok(fs.existsSync(path.join(coreInfra, 'README.md')),
-    'infra/README.md explains the two populations — without it the nine absences read as breakage again (task 1003635)');
-});
-
-for (const d of tmps) { try { fs.rmSync(d, { recursive: true, force: true }); } catch { /* best-effort */ } }
-summary();